3 ms·

I want to look into adding support for sniffing and forwarding the 802.1x packets that the AT&T fiber modem/gateways use to authenticate. This is done to bypas

I want to look into adding support for sniffing and forwarding the 802.1x packets that the AT&T fiber modem/gateways use to authenticate. This is done to bypass the crappy performance and insecurity of their device. There are some hacky implementations of this but I want to do it in Go. I've gotten as far as sniffing the packets using gopacket under FreeBSD. Unfortunately, FreeBSD doesn't seem to support VLAN 0 so I was unable to implement this for PFSense. Perhaps router7 would be a better option for me.

secure 8y ago
Definitely give it a shot! If it doesn’t work for you as-is, maybe you can hack on it until it does. Let me know if you get stuck, maybe I can give a pointer.
ryan-c 8y ago
From what I can tell, AT&T's "VLAN 0" exists in order to use 802.1p priority tags. Maybe you can just enable 802.1p?
- MertsA 8y ago
  No, they actually use 802.1x to authenticate the connection. 802.1x doesn't actually protect or authenticate any of the data though, it just ensures that there's a valid supplicant somewhere on the other end of a port before it forwards traffic.
  - ryan-c 8y ago
    I didn't say anything about 802.1x in my comment, and I'm one of the folks that has published information about how to bypass these crappy AT&T routers.
dev_dull 8y ago
Yes please! I love my fiber, but being stuck with this interminable box as the first hop is driving me crazy. And performance drops significantly with pass-through mode.
jokamoto 8y ago
This is a functional implementation of that behavior in Go: https://github.com/mjonuschat/eap_parrot https://github.com/mjonuschat/eap_parrot
- secure 8y ago
  Neat! In case anyone wants to use this on router7, where CGO_ENABLED=0, you’d need something like https://github.com/google/gopacket/pull/470 https://github.com/google/gopacket/pull/470
  - deleted 8y ago
    [deleted]
- chrissnell 8y ago
  Wow, that's awesome. I'm not sure if it can handle the VLAN 0 packets on FreeBSD, though. Still, this is a strong start and I want to see if I can adapt this for router7.
deleted 8y ago
[deleted]

secure 8y ago

Definitely give it a shot! If it doesn’t work for you as-is, maybe you can hack on it until it does. Let me know if you get stuck, maybe I can give a pointer.

ryan-c 8y ago

From what I can tell, AT&T's "VLAN 0" exists in order to use 802.1p priority tags. Maybe you can just enable 802.1p?

MertsA 8y ago
No, they actually use 802.1x to authenticate the connection. 802.1x doesn't actually protect or authenticate any of the data though, it just ensures that there's a valid supplicant somewhere on the other end of a port before it forwards traffic.
- ryan-c 8y ago
  I didn't say anything about 802.1x in my comment, and I'm one of the folks that has published information about how to bypass these crappy AT&T routers.

dev_dull 8y ago

Yes please! I love my fiber, but being stuck with this interminable box as the first hop is driving me crazy. And performance drops significantly with pass-through mode.

jokamoto 8y ago

This is a functional implementation of that behavior in Go: https://github.com/mjonuschat/eap_parrot https://github.com/mjonuschat/eap_parrot

secure 8y ago
Neat! In case anyone wants to use this on router7, where CGO_ENABLED=0, you’d need something like https://github.com/google/gopacket/pull/470 https://github.com/google/gopacket/pull/470
- deleted 8y ago
  [deleted]
chrissnell 8y ago
Wow, that's awesome. I'm not sure if it can handle the VLAN 0 packets on FreeBSD, though. Still, this is a strong start and I want to see if I can adapt this for router7.

deleted 8y ago

[deleted]