Query: Strange broadcast packets

Thread View: comp.dcom.lans.ethernet

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by Al Berg Thu, 09 Mar 1995 21:13

#1196

Author: Al Berg
Date: Thu, 09 Mar 1995 21:13

20 lines
1640 bytes

When looking at trace of a client's network recently, one of my colleagues
found a strange thing:

Virtually all of the traffic on the LAN is Novell IPX and SPX based.

Approximately 1% of all packets examined appeared to have corrupt
MAC-layer headers. These packets appeared to be generated by all devices
on the network: workstations, servers, even print servers. In these
'corrupt' packets, the normal source address/destination address
indicators were replaced with hexadecimal FFThis anomaly causes every
device on the network to examine every one of these corrupt packets,
and usually triggers a retransmission.

The network seems 'clean' in other respects - physical level errors were
almost non existent.

Has anyone seen anything similar?

Thanks
Al

Re: Query: Strange broadcast packets

#1195

Author: Peter Macaulay
Date: Sun, 12 Mar 1995 13:50

38 lines
2732 bytes

In article <D56yz2.Kt0@ritz.mordor.com> spy@ritz.mordor.com (Al Berg) writes:
>
>Approximately 1% of all packets examined appeared to have corrupt
>MAC-layer headers. These packets appeared to be generated by all devices
>on the network: workstations, servers, even print servers. In these
>'corrupt' packets, the normal source address/destination address
>indicators were replaced with hexadecimal FF. This anomaly causes every
>device on the network to examine every one of these corrupt packets,
>and usually triggers a retransmission.
>

 Just wanted to understand your problem.  What do you mean by FFs.
 If the Ethernet header is 6 bytes of FF, followed by 6 bytes of a
 valid serial number this would be a normal broadcast.  The frame
 would look like this ...

    A) Destination S/N   Source S/N        Novell
       ----------------- ----------------- -----
       FF-FF-FF-FF-FF-FF 11-22-33-44-55-66 81-37

 If the source and destination addresses are all FF this would be
 more fun.  The packet would look like ...

    B) Destination S/N   Source S/N
       ----------------- ----------------- -----
       FF-FF-FF-FF-FF-FF FF-FF-FF-FF-FF-FF 81-37

 Do you have packets looking like A or B above?  If it is A, then
 you have broadcast packets.  If it is B, how can you say these are
 generated by all devices on the network?  Also, what tool did you
 use to collect the Ethernet packets?  Hope these questions take
 you closer to an answer.

---------------------------------------------------------------
Peter Macaulay                       Internet: pmac@fox.nstn.ca
Network Consulting & Training                 Tel: 902/454-6878
(Windows NT user)                             Fax: 902/454-5226

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads