🚀 go-pugleaf

I asked if anyone knew about some Ethernet packets with type 0x6002
I'd seen flying about on our LAN. It would seem that they are generated 
automatically by our DEUNA boards every ten minutes. My thanks to George
Ross and Steven Bellovin for this information.

After searching through the DEUNA manual for a while, I discovered how
to turn these messages off using the "Write Mode" command - see section
4.4.9 and table 4-22. Our DEUNA driver obviously doesn't disable this 
feature at boot-time.

I would guess that the Perq is picking up the multicast packets
because the 3Com board has been instructed to accept all multicasts,
(or perhaps this is its default state - is this part of the 802.3 spec?)

Hope this is of some help to anybody else out there who is concerned
about just what goes up and down their Ethernet!

Robert Stroud  (...!ukc!cheviot!robert)

-------------------------------------------------------------------------
From: George Ross <ukc!edcaad!cstvax!gdmr>

... According to the DEUNA section of the VMS I/O manual (5B in the V3 set) 
the destination multicast address of these packets (AB-00-00-02-00-00) 
corresponds to "Remote Console", and protocol type 6002 also corresponds 
to "Remote Console". My suspicion is that the DEUNA itself is sending these 
things, since they are coming from both a VMS machine (which might have 
been expected) and a UNIX machine (which seems unlikely otherwise).

--------------------------------------------------------------------------
From: Steven Bellovin <mcvax!seismo!ulysses!smb>

The message is a "system ID" message generated every 10 minutes by your
DEUNA boards.  (I can tell they're DEUNAs from the source address field.)
See Figure 4-34 and Table 4-41 in the DEUNA manual, and the following pages.
The destination address you cite, ab-00-00-02-00-00, is indeed a multicast
address (the low-order bit of the first byte is on), and is the "Remote 
Console Service" multicast address.