For Spanning Tree traffic, the source MAC address should be the MAC associated with the bridge (switch) itself. This is *probably* the MAC address of the management interface of the switch, but some switches - like Nortel Passports - have a separate MAC address for each port on the switch, so it may be unique. See your switch documentation for STP.
The destination MAC address will be a layer 2 multicast address unique to STP. You won't find this as a source anywhere on the network because it's a group address (multicasts should *never* be sources). The MAC address will be 01:80:C2:XX:XX:XX, where XX:XX:XX is probably 00:00:00.
The packets are sent to a layer 2 multicast addres so that all bridges on that LAN segment will receive the packet.
STP packets should NEVER, EVER be forwarded. While the reception of an STP packet may cause a bridge to generate its own STP packets on other segments, the original packet itself is never forwarded. According to the 802.1D spec, this includes switches that are not participating in the STP algorithm. They should just drop the BPDUs.
For obvious reasons, some modern switches can be told to forward STP BDPUs when STP is disabled so that the switch is truly invisible and does not break the STP process running on the surrounding switches. While this is kinda handy, it is a technical violation of the spec, so tread carefully...
--J
> -----Original Message-----
> From: ethereal-users-bounces@xxxxxxxxxxxx
> [mailto:ethereal-users-bounces@xxxxxxxxxxxx]On Behalf Of Mah
> Horng Liang
> Sent: Monday, October 06, 2003 10:37 PM
> To: ethereal-users@xxxxxxxxxxxx.
> Subject: [Ethereal-users] Some question
>
>
> I could understand all the traffic capture! but 1 of the type
> of traffic I couldn't understand..
>
> Destination: xxx (Spanning-tree-(for-briges)_01)
>
> I guess this is the traffic generate by ethernet switch!! The
> destination & source MAC addr couldn't found inside my
> network ! Wish u can explain the status !!
>
> regard
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>