Home page

IPoE (IP over Ethernet) Definition, Architecture & Specifications

LINK-PP Official 　·

Sep 21,2026

IP over Ethernet (IPoE) is a network access methodology that encapsulates Internet Protocol (IP) datagrams directly into Ethernet frames without the use of intermediate tunneling protocols. Primarily deployed in Broadband Network Gateway (BNG) architectures, Fiber to the Home (FTTH), and large-scale enterprise networks, IPoE relies on DHCP (Dynamic Host Configuration Protocol) for IP allocation and topology-based subscriber management. By eliminating legacy session layers, it provides lower encapsulation overhead, native MTU compliance, and seamless IP multicast support for modern data, voice, and IPTV services.

What is IPoE?

IPoE is a highly efficient Layer 2/Layer 3 encapsulation and access control framework utilized in modern broadband and service provider topologies. Unlike legacy broadband access protocols which layered IP over PPP (Point-to-Point Protocol) over Ethernet, IPoE directly maps IP payloads to the 802.3 Ethernet standard. Subscriber identification, authentication, and policy enforcement are abstracted from the data plane and managed via control-plane protocols, predominantly using DHCP Option 82 (Relay Agent Information Option) injected by intermediate access nodes such as DSLAMs or OLTs.

By removing the stateful session encapsulation required by Point-to-Point architectures, IPoE minimizes hardware interrupt overhead on both Customer Premises Equipment (CPE) and carrier-edge routers. It resolves historical Maximum Transmission Unit (MTU) fragmentation bottlenecks and inherently supports IP multicast streaming, establishing itself as the de facto transport methodology for high-bandwidth, convergent triple-play networks.

Technical Background and Evolution

The architectural transition to IPoE was driven by the computational and functional limitations of PPPoE (Point-to-Point Protocol over Ethernet) in scaling to gigabit broadband speeds. PPPoE was originally designed in the late 1990s to bridge legacy dial-up AAA (Authentication, Authorization, and Accounting) models into early DSL deployments, utilizing RADIUS and CHAP/PAP for user credential verification over a persistent tunnel.

As service provider infrastructure migrated from ATM-based transport to pure Carrier Ethernet and PON (Passive Optical Network) topologies, the 8-byte overhead of PPPoE headers became a measurable inefficiency. More critically, PPP is strictly a unicast protocol. Delivering live video (IPTV) via multicast over a PPPoE network required highly complex engineering workarounds, such as discrete IGMP snooping combined with multi-session CPE termination, which heavily taxed access equipment. IPoE evolved to resolve these bottlenecks by treating the access loop as a native IP domain, decoupling the physical access medium from subscriber logical sessions and delegating authentication to the network topology itself.

How IPoE Works

Encapsulation and Data Plane Architecture

In an IPoE architecture, the data plane is strictly governed by standard Ethernet framing (IEEE 802.3) and IP routing (IETF RFC 894). The IPv4 or IPv6 packet is encapsulated directly within the Ethernet payload, utilizing the standard MTU of 1500 bytes without any payload truncation or secondary header injection. This direct 1:1 mapping eliminates the need for encapsulation and decapsulation cycles at the BNG and CPE, significantly reducing latency, jitter, and ASIC processing overhead.

Subscriber Authentication (DHCP Option 82)

Because IPoE lacks native session-layer authentication, it relies on network-topology-based security models. When a CPE initiates a DHCP Discover message, the intermediate access node (e.g., a PON OLT or Layer 2 aggregation switch) intercepts the packet and appends DHCP Option 82. This metadata tag contains the Agent Circuit ID (identifying the specific physical port or VLAN of the subscriber) and the Agent Remote ID (the CPE MAC address or optical network terminal ID). The DHCP server or BNG forwards this hardware metadata to the RADIUS/AAA server, which authenticates and provisions the user securely based on their physical connection point rather than a vulnerable user-supplied password.

Session Management and Keepalives

Unlike PPP which maintains a continuous L2CP (Link Control Protocol) keepalive, IPoE is fundamentally stateless at the data link layer. Subscriber session state on the BNG is maintained via DHCP lease timers and automated ARP/NDP (Address Resolution Protocol / Neighbor Discovery Protocol) polling. If a CPE fails to renew its DHCP lease, or repeatedly fails to respond to unicast ARP/NDP polling, the BNG identifies the session as dead, tears down the subscriber instance, and generates a stop-accounting record for billing systems.

Multicast Integration (IGMP/MLD)

IPoE supports native edge execution of IGMP (Internet Group Management Protocol) for IPv4 and MLD (Multicast Listener Discovery) for IPv6. Multicast traffic is dynamically replicated at the optimal edge access node rather than being duplicated into individual unicast tunnels at the core routing layer. This architectural feature is essential for optimizing backbone bandwidth utilization during live IPTV broadcasting.

Key Specifications

Data Encapsulation: Direct IP payload over IEEE 802.3 Ethernet (No intermediate tunnel headers).
Standard MTU: 1500 Bytes (Bypasses the 1492-byte limitation of PPPoE, inherently preventing TCP MSS clamping and IP fragmentation).
Authentication Mechanisms: Port-based / Topology-based via DHCP Option 82 (RFC 3046), MAC-Address Bypass (MAB), or IEEE 802.1X.
Session Control: Managed autonomously via DHCP Lease intervals, ARP/NDP polling, and optionally BFD (Bidirectional Forwarding Detection).
IP Protocol Support: Dual-stack capabilities (IPv4 and IPv6 natively supported via DHCPv4, DHCPv6, and SLAAC).
Multicast Compatibility: Native Layer 2/Layer 3 multicast compatibility (IGMP v2/v3, MLD v1/v2).

Typical Use Cases

1. FTTH (Fiber to the Home) and Gigabit Broadband: Tier-1 telecommunication carriers deploy IPoE over GPON and XGS-PON architectures to deliver unbottlenecked high-speed internet. The lack of encapsulation overhead permits line-rate symmetric gigabit throughput on consumer-grade routers without CPU exhaustion.

2. IPTV and Convergent Service Networks: Due to its native support for IGMP snooping and downstream multicast replication, IPoE is the mandatory access standard for service providers delivering live linear television alongside VoIP and high-speed data.

3. 5G Fixed Wireless Access (FWA): Modern FWA architectures utilize IPoE for cellular-to-ethernet subscriber aggregation. It seamlessly integrates with standard 5G UPF (User Plane Function) packet cores where tunnel-in-tunnel overhead must be strictly avoided.

4. Large-Scale Enterprise and Campus Networks: Enterprise environments requiring zero-touch provisioning deploy IPoE combined with Captive Portals and MAC-auth-bypass to securely onboard massive volumes of transient IoT and guest clients without manual client-side configuration.

Related Technologies and Terms

PPPoE (Point-to-Point Protocol over Ethernet): The legacy alternative to IPoE. It utilizes an 8-byte header for session management and CHAP/PAP authentication, forcing a lower MTU (1492 bytes) and higher equipment CPU overhead.
BNG (Broadband Network Gateway) / BRAS: The carrier-grade edge routing equipment that terminates IPoE subscriber sessions, handles IP address allocation, applies QoS (Quality of Service), and enforces bandwidth policies.
DHCP Option 82: A critical sub-protocol standard in IPoE topologies that allows edge network equipment to inject port, line profile, and switch metadata into a DHCP request, enabling secure, credential-less authentication.
IEEE 802.1Q (VLAN Tagging): Used in conjunction with IPoE to securely isolate subscriber traffic across a Layer 2 domain. Providers typically use a 1:1 VLAN per subscriber (C-VLAN) or an N:1 Service VLAN (S-VLAN) combined with IPoE data flows.

Frequently Asked Questions (FAQs)

What is the primary architectural difference between IPoE and PPPoE?

The core difference lies in encapsulation and session state. PPPoE encapsulates IP packets inside a Point-to-Point tunnel, adding an 8-byte overhead and relying on active L2CP keepalives and CHAP/PAP for authentication. IPoE transmits IP packets directly over Ethernet with zero additional overhead, utilizing DHCP and physical port mapping (Option 82) for stateless subscriber management.

How does IPoE handle subscriber authentication without a username and password?

IPoE utilizes topology-based authentication. When a client requests an IP address via DHCP, the upstream access node (such as an OLT or DSLAM) intercepts the request and inserts DHCP Option 82. This securely identifies the physical port, MAC address, and line profile of the subscriber. The BNG passes this metadata to the AAA/RADIUS server, authenticating the user strictly based on their physical, authenticated network line.

Why is IPoE fundamentally better for IPTV and video broadcasting?

IPTV relies on IP Multicast to efficiently distribute video streams to multiple subscribers simultaneously. PPPoE is a unicast point-to-point tunnel, making multicast distribution highly inefficient by forcing the core router to replicate traffic for every individual tunnel. IPoE utilizes native Ethernet and IP layers, seamlessly supporting IGMP snooping and allowing multicast streams to be replicated at the network edge (e.g., at the OLT), which dramatically reduces backbone bandwidth consumption.

Does IPoE resolve the MTU fragmentation issues found in legacy broadband?

Yes. PPPoE forcibly reduces the standard Ethernet Maximum Transmission Unit (MTU) from 1500 bytes down to 1492 bytes to accommodate its tunnel header, frequently causing TCP MSS (Maximum Segment Size) mismatches and IP packet fragmentation. IPoE preserves the full 1500-byte MTU, ensuring native end-to-end packet transmission without fragmentation, improving latency and reducing router CPU loads.

How is a disconnected subscriber session detected in a stateless IPoE architecture?

Unlike PPPoE, which uses continuous PPP keepalives to immediately detect a dropped link, IPoE is stateless at the access layer. Session termination is reliably detected via DHCP lease expiration, ARP/NDP polling failures (where the BNG actively pings the client's MAC address), or through immediate port-down signals triggered by the access node and passed to the BNG via RADIUS accounting-stop messages.

Industry Standards Involved

IETF RFC 894 (A Standard for the Transmission of IP Datagrams over Ethernet Networks): Defines the foundational MAC-layer mapping and encapsulation of IP datagrams within standard Ethernet frames.
IETF RFC 2131 (Dynamic Host Configuration Protocol): Governs the IPv4 address assignment mechanism which functions as the control plane for bringing up and tearing down an IPoE subscriber session.
IETF RFC 3046 (DHCP Relay Agent Information Option): Standardizes DHCP Option 82, the critical parameter enabling secure, topology-based authentication in carrier IPoE access networks.
IEEE 802.3 (Ethernet): Defines the physical and data link layer standards that transport IPoE traffic without intermediate tunneling.
IEEE 802.1Q (VLANs): Specifies the VLAN tagging architecture (including C-VLAN and S-VLAN constructs) used to securely isolate discrete IPoE subscriber traffic across a shared Layer 2 access network.

Summary

IPoE (IP over Ethernet) represents a definitive architectural shift in broadband access and enterprise networks, stripping away the legacy encapsulation overhead of Point-to-Point protocols to deliver a highly efficient, stateless, and scalable access methodology. By coupling native Ethernet encapsulation directly with DHCP-driven authentication and session management, IPoE empowers network operators to deliver symmetric gigabit throughput, uncompromised 1500-byte MTU paths, and highly optimized multicast streaming for next-generation triple-play and FTTH deployments.

While the transition from PPPoE to IPoE introduces a paradigm shift in how subscriber states and billing records are maintained—shifting reliance to topology-aware mechanisms like DHCP Option 82 rather than persistent Layer 2 tunnels—the engineering trade-offs overwhelmingly favor IPoE. As global infrastructure continues to evolve toward 10G PON, 5G FWA, and software-defined disaggregated access nodes, IPoE remains the foundational IP transport standard, ensuring hardware efficiency, seamless IPv6 migration, and robust interoperability across diverse vendor ecosystems.