PPP tunnel problem

[dnordenberg]

Hi!
I’m trying do do a PPP serial tunnel between two RB devices. It somewhat works but I have some strange fenomenas.
First I seem to get a lots of junk traffic on the tunnel, I see that the lights of the serial connect is blinking extremly fast and until connection seem to reset and calms down a bit and then it start talking more and more and squence repeats itself again. The only traffic that is sent over the tunnel is a modbus TCP (port 502) from host 172.16.11.34 on one side to .11.36 on the other side of the PPP tunnel.
When I do a packet capture on the ppp-in interface I don’t even see the request packet from .11.34 to .11.36 but I do see the response from .11.36 to .11.34 now and then so that means the .11.36 sometimes gets a request packets even if that isn’t visible in the packet dump. Very strange. I wonder if a PPP interface packet capture bug is part of my problem? It records lots of “bogus” packets where IP version IP version is set to 0 (should be 4 as wireshark sais) and IP addresses looks completely wrong. See image for a short example. A full 4 second capture is attach in zip file.
Can someone help me explain this?

PPP server is setup like this (tunneled, not routed):

export hide-sensitive (PPP parts)
/ppp profile
set *0 bridge=bridge1 local-address=1.1.1.1 remote-address=1.1.1.2 use-compression=yes
/ppp secret
add name=ppp1
/interface ppp-server
add disabled=no name=ppp-in1 null-modem=yes port=serial0 ring-count=0

RouterOS 6.46.4
model = 450G

dump.zip (4.18 KB)

[dnordenberg]

Here is exactly the same communication seen from the ethernet interface instead of ppp-in. Looks better and shows traffic from both directions (but I had to disable HW offload on the bridge port otherwise I saw only rx packets?).
But still some strange red packets in wireshark But not as many “junk” packets as seen on the ppp-in interface. All those packets really tests the limits of my modem connection I’m expecting to see 5pps in each direction on the ppp-in interface but I can sometimes see up to 60pps each direction until communication stops for a short while and calms down. It’s like some packets is accumulating and re-transmitted over and over again, not sure if this is caused by something wrong with the tunnel or if it is the two hosts communicating with each other that is starting to misbehave. For sure they would not be doing that with a straight ethernet cable between them.

dump2.zip (1.73 KB)

[dnordenberg]

And another extremely strange thing, turning on the packet sniffer seems to make communication behave much better. This is not a single happening, I can reproduce it over and over again, when the pps rate is rocketing I can calm it down instantly by starting the packet sniffer on the eth interface. (I’m not controlling the RB device over the ppp connection or something like that).