On Sat, Dec 20, 2003 at 12:06:17AM -0800, Vijay Kumar wrote:
> I am receiving a broadcast packets on my network of Ethertype x886f
> sourced from MAC address 02:01:00:00:00:00 and destination is
> ff:ff:ff:ff:ff:ff
> On some ethereal , I can see this broadcast as "MS NLB heartbeat"
> and on some I just see them as "Ethernet II"
Ethereal first recognized that in 0.9.16; older versions won't recognize
it.
> Also I have read the link :
> http://www.ethereal.com/lists/ethereal-users/200202/msg00013.html
>
> But I am not able to find the source IP Address / machine.
Those packets just run atop Ethernet; there *is* no source IP address.
> Please help me in finding out the solution.
>
> Currently I am also trying to change the HUB and check whether the
> problem is on the HUB.
You say "problem" and speak of a "solution"; this isn't necessarily a
problem. Those packets appear to be sent out with a Windows 2000 server
feature:
http://www.microsoft.com/technet/treeview/default.asp?url=/TechNet/prodtechnol/windows2000serv/deploy/confeat/nlbovw.asp
(about which I know nothing, so if you want details, check that URL).
Perhaps the only "problem" is that you have, on your network, Windows
2000 (or Windows 2003 Server?) machines with the Network Load Balancing
feature enabled.