Subject: Re: weird packet found...help?
To: Andrew Brown <atatat@atatdot.net>
From: Bill Sommerfeld <sommerfeld@orchard.arlington.ma.us>
List: tech-net
Date: 11/28/1999 01:23:13
> i've been watching my network (just to see what's out there) and i've
> found several packets of the form
> 
> 15:04:20.729215 55:55:55:55:55:55 58:55:55:55:55:55 800c 5461:
>                          5555 fcff 5555 fcff 5555 fcff 5555 fcff
>                          5555 fcff 5555 fcff 5555 fcff 5555 fcff
>                          5555 fcff 5555 fcff 5555 fcff 5555
> 
> which have me totally confused.  the src and dst hardware addresses
> (as shown above, other variants were seen as well) are not in use
> anywhere that i can tell by any machine on my network.
> 
> the prefix 55:55:55 isn't listed in any of the lists of ethernet
> vendors that i can find.

What interface hardware/driver was this?

This is probably the wreckage from a collision.

At least some drivers program the cards to return *everything* they
get in promiscuous mode, including runts and packets with bad CRC's.

					- Bill