Techniques for operating a network interface include automatically determining whether communications are terminated over a particular attachment circuit on a network interface on an intermediate network node at an edge of a provider network, whereby a sign of death (SOD) on the particular attachment circuit is indicated. The attachment circuit is switched with a particular virtual private network that is a link layer virtual private network (VPN) encapsulated in a higher layer protocol. The provider network is a packet-switched network. The network interface is for a direct communication link to a customer network node outside the provider network. If it is determined that there is an indication of the SOD, then a new network action is initiated in response to the SOD on the particular attachment circuit. These techniques allow for automatic logging of usage, billing, and fault detection, as well as for over-subscription of network resources for multiple VPNs.