PPPoE LCP Terminate Requests - is it possible to increase logging debug level

[laczik]

I am connected to Zen (UK) via a Vigor modem (in bridge mode) and PPPoE, and getting regular (sort of) LCP terminate requests (see log below e.g. for today). There is no indication in the logs as to what is triggering
this.

Is there any way to increase the verbosity of PPPoE logging?

Thanks, John

OPNsense 20.7.3-amd64
FreeBSD 12.1-RELEASE-p10-HBSD
LibreSSL 3.1.4

# clog /var/log/ppps.log | grep 'Terminate Request'
Jan  5 00:30:57 gw ppp[86931]: [opt4_link0] LCP: rec'd Terminate Request #2 (Opened)
Jan  5 01:31:04 gw ppp[86931]: [opt4_link0] LCP: rec'd Terminate Request #2 (Opened)
Jan  5 02:31:16 gw ppp[86931]: [opt4_link0] LCP: rec'd Terminate Request #2 (Opened)
Jan  5 03:31:29 gw ppp[86931]: [opt4_link0] LCP: rec'd Terminate Request #2 (Opened)
Jan  5 04:31:34 gw ppp[86931]: [opt4_link0] LCP: rec'd Terminate Request #2 (Opened)
Jan  5 16:33:36 gw ppp[86931]: [opt4_link0] LCP: rec'd Terminate Request #2 (Opened)
Jan  5 17:33:50 gw ppp[86931]: [opt4_link0] LCP: rec'd Terminate Request #2 (Opened)

[schnipp]

It looks like your ISP terminates the connection. You can make a packet dump and look into in more detail.

[laczik]

It looks like your ISP terminates the connection.

Yes, I agree - that's what I thought.

You can make a packet dump and look into in more detail.

Added to section pppoeclient: in /var/etc/mpd_opt4.conf:
  log +echo

Will check tomorrow if that shows any more info.

Doing a packet dump is not easy since the 'LCP Terminate Request' may not arrive for many hours...

[laczik]

Adding 'log +echo' to /var/etc/mpd_opt4.conf did not show anything.

Zen tech support asked me to jump through the usual hoops of reset, restart,
check cables, etc. and contact them again if the problem persists.

I am now running
tcpdump -v -i igb0 -n -s 0 -w test.cap  'ether[0x0c:2] == 0x8863 or (ether[0x0c:2] == 0x8864 and (ether[0x14:2] == 0xc021 or ether[0x14:2] == 0xc223 or ether[0x14:2] == 0x8021 or ether[0x14:2] == 0x8057))'
Will keep it running for a day or two, and will then check if there is anything in the cap file...

In the meantime, any additional suggestions would be most welcome.

[schnipp]

You are on the right way to monitor only the relevant control traffic

[BuddhaBelly]

Out of interest - I'm using a different firewall but getting the same thing. 

Did you ever get to the bottom of it?