What you are seeing is completely correct. By default Spanning Tree (STP) sends mac level multicast packets every two seconds. All ports that have Spanning Tree, or one of the many STP flavors enabled, will have something like this.
One of the foundation texts for network analysis is "Interconnections.." by Radia Perlman. She wrote version one while working for DEC back in the day. IMHO, everyone who looks a packets should have this text in their library. (I don't intend to start a flame war about what is "best", this is just my opinion from an old guy who remembers vampire taps, etc...)
Alex Lindberg
--- On Tue, 4/21/09, C
H <sea.kayaker@xxxxxxxxx> wrote:
From: C H <sea.kayaker@xxxxxxxxx>
Subject: [Wireshark-users] Cisco traffic
To: "wireshark" <wireshark-users@xxxxxxxxxxxxx>
Date: Tuesday, April 21, 2009, 1:30 PM
I'm trying to troubleshoot some network traffic issues and found a packet with a delta time that's a bit long. It's generated by a cisco device (probably the switch, since it shows a Spanning Tree Protocol), but not sure why the delta time is a bit long. Any thoughts?
Delta time: 1.98... seconds
Source: Cisco_93:18:8b
Destination: PVST+
Protocol: STP
Info Conf. Root = 8193/00:1b:8f:8f:5a:00 Cost=4
Port=0x800b
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe |