They might be keep alive packets for either Windows NT
server load balancing/failover or Intel NIC failover.
Both have their own ether type and I can't find them
at moment. Will see if I can find the info again...
--- "Jesus M. Salvo Jr." <jsalvo@xxxxxxxxxxxxxxxxx>
wrote:
> A bit offtopic, but ... I can't figure out what
> these ethernet packets
> are with ether type 0x886d, which is being shown on
> ethereal, with 46
> bytes of data.
> The source is a MAC address of whatever host it was
> being sent from,
> while the destination is the broadcast address
> ff:ff:ff:ff:ff:ff.
>
> There seems to be two hosts communicating with this
> ether type through
> broadcast. One seems to be sending the payload, and
> the other seems to
> be responding with the same payload .... then the
> data payload changes
> ... etc .... Almost like an ICMP echo request and an
> ICMP echo reply.
>
> I know 0x0800 is IP, but searching the RFC (
> www.normos.org )... there
> does not seem to be an ether type 0x886d. The
> closest seems to be 0x8864
> which is for PPPoE session.
>
> Anyone knows what it is?
>
>
>
> Here is an example:
>
>
>
> Frame 69 (60 on wire, 60 captured)
> Arrival Time: Feb 7, 2001 10:40:58.0219
> Time delta from previous packet: 1.312458
> seconds
> Time relative to first packet: 58.933777 seconds
> Frame Number: 69
> Packet Length: 60 bytes
> Capture Length: 60 bytes
> Ethernet II
> Destination: ff:ff:ff:ff:ff:ff
> (ff:ff:ff:ff:ff:ff)
> Source: 00:d0:b7:48:b5:b7 (00:d0:b7:48:b5:b7)
> Type: Unknown (0x886d)
> Data (46 bytes)
>
> 0 0001 0001 2372 0300 0200 00d0 b748 b5b7
> ....#r.......H..
> 10 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> 20 0000 0000 0000 0000 0000 0000 0000
> ..............
>
> Frame 70 (60 on wire, 60 captured)
> Arrival Time: Feb 7, 2001 10:40:58.0219
> Time delta from previous packet: 0.000002
> seconds
> Time relative to first packet: 58.933779 seconds
> Frame Number: 70
> Packet Length: 60 bytes
> Capture Length: 60 bytes
> Ethernet II
> Destination: ff:ff:ff:ff:ff:ff
> (ff:ff:ff:ff:ff:ff)
> Source: 00:b0:d0:22:26:1b (00:b0:d0:22:26:1b)
> Type: Unknown (0x886d)
> Data (46 bytes)
>
> 0 0001 0001 2372 0300 0100 00d0 b748 b5b7
> ....#r.......H..
> 10 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> 20 0000 0000 0000 0000 0000 0000 0000
> ..............
>
>
> John
>
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
>
http://www.ethereal.com/mailman/listinfo/ethereal-users
__________________________________________________
Do You Yahoo!?
Yahoo! Auctions - Buy the things you want at great prices.
http://auctions.yahoo.com/