Ethereal-users: Re: [Ethereal-users] Source MAC address while capturing with wireless device

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 14 Jan 2006 00:28:19 -0800
Gentoo_Newbie wrote:
I am doing captures with Ethereal with my wireless device. Can anyone tell me why my source MAC address is aa:aa:03:00:00:00 ?
Because the driver is supplying packet headers that don't match the ARPHRD_ type, or is supplying a fake MAC address. aa:aa:03 is the LLC header for a SNAP packet, and 00:00:00 is an OUI, which would follow the LLC header in a SNAP packet, and it'd indicate that what follows is an Ethernet type value.
Perhaps the driver or the card is supplying a fake Ethernet header, although, given that 802.11 packet have destination and source MAC addresses, I'm not sure why it's doing it in that fashion.
What type of wireless device do you have? (I assume from your e-mail name that the machine is running Gentoo Linux.)