Hello, everyone!
Today, I'd like to share a case with you.
Product Model: SmartAX MA5600T and EchoLife HG8247H
Problem Description
The user needs support to identify the final client request, and he reports that continuous active traffic is detected in his ONT, even though he has neither a connected device nor a LAN nor a WAN. According to the user, if there is no device on the ONT, there is no data download size. Data consumption ranges from 1276 kbit/s to 8278 kbit/s.
Problem Analysis
Topology:
The user provided the following information:
The user changes the VLAN of the ONT but still uses the data. MAC address validation was performed, it was removed from the OLT and it reappeared mac address.
The ONT is configured to work in bridging mode, but data consumption still exists. The service is configured to another ONU ID for testing, but the data consumption still exists.
Real-time data consumption:
ONT 4 (common ONT):
Perform the following operations because the traffic cannot be separated by checking the statistics on the OLT. 1. Capture packets on the PON port through mirroring. Please capture 3-5 minutes. Based on the bandwidth consumption, 1 GB is available in 300 seconds. 2. After capturing packets, collect ONT one-click information.
According to the information provided by the user, the analysis is as follows:
1. The log shows that multiple terminals are connected to the ONT. The IP address of the terminal is as follows:
2. Connect the LAN1/2/4 interface and learn the MAC address.
From the captured packets, it has many multicast streams:
3. From the perspective of connection sessions, all connected devices have session interactions with upper-layer servers. Therefore, even if the terminal device does not actively trigger a service, a program running on the terminal device may trigger service execution in the background.
Next Steps:
If no device is connected to the ONT and the traffic volume ranges from 1 Mbit/s to 8 Mbit/s, capture packets through mirroring on the web page.
The procedure is as follows: 1. Configure mirroring packet capture on the PON port.WAP>setethportmirror Source port 10 Destination port 2 Mirroring date 2 Enable 1 Mirror the PON port to the LAN2 port. Connect the PC to the LAN2 port to capture packets. 2. Enable web page packet capture.
3. Use Wireshark to capture packets.
Root Cause
The large multicast bandwidth sent from the OLT to ONT ranges from 3-8Mbps, and from the capture file, it shows the multicast source and destination. For the remaining traffic, it shows the end-user exchange DNS, etc.
Solution Description
Provides users with an analysis report that shows that the traffic is multicast and indicates the source and destination IP addresses.
Welcome to leave a message below.
We study together.
Thank you!
