Subject: weird packet found...help?
To: None <tech-net@netbsd.org>
From: Andrew Brown <atatat@atatdot.net>
List: tech-net
Date: 11/28/1999 00:10:38
i've been watching my network (just to see what's out there) and i've
found several packets of the form

15:04:20.729215 55:55:55:55:55:55 58:55:55:55:55:55 800c 5461:
                         5555 fcff 5555 fcff 5555 fcff 5555 fcff
                         5555 fcff 5555 fcff 5555 fcff 5555 fcff
                         5555 fcff 5555 fcff 5555 fcff 5555

which have me totally confused.  the src and dst hardware addresses
(as shown above, other variants were seen as well) are not in use
anywhere that i can tell by any machine on my network.

the prefix 55:55:55 isn't listed in any of the lists of ethernet
vendors that i can find.

    ftp://ftp.cavebear.com/pub/Ethernet.txt
    ftp://ftp.isi.edu/in-notes/iana/assignments/ethernet-numbers
    http://standards.ieee.org/regauth/oui/oui.txt

and neither is the frame type 800c anything i've seen before.  my only
guess is that it's a collision as seen by a third station, but that's
a long shot.  has anyone ever seen anything like this before?  any
guesses as to what it might be?

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."