First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Ethernet II frames with random MAC destinations?

  • retag add tags

I am monitoring a home network and I see periodic Ethernet II frames sent from 00:00:00:00:00:00 to random MACs xx:xx:xx:xx:00:00. For example:

image description

Frame 96694: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 1a:88:51:05:00:00 (1a:88:51:05:00:00)
    Destination: 1a:88:51:05:00:00 (1a:88:51:05:00:00)
    Source: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Type: Unknown (0x0000)
Data (46 bytes)
    Data: 000000000000000000000000000000000000000000000000…
    [Length: 46]

The last 4 of dst is always 00:00. The type is always Unknown (0x0000). The data is always 46 bytes of zeroes. I have no idea what could be sending this. It is a typical home network. Amazon Fire Stick, LG TV, Playstation, some Android phones, some Android tablets, some Windows laptops and a Windows desktop (what I'm using Wireshark on and it's connected to the Linksys router via ethernet cable).

nomin's avatar
3
nomin
asked 2019-12-23 07:11:44 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

That would be indicative of a failing network device. The frame data seems to suggest that a (residual?) 32 bit word is (assumed to be) present in a frame descriptor block in the network driver. The networking hardware makes this a valid length Ethernet frame by padding with zeros. Disclaimer: this are no more than educated guesses, but fitting the (limited) evidence.

To be able to find this device you would have to backtrack through the network ports, looking for this type of frames.

Jaap's avatar
13.7k
Jaap
answered 2019-12-23 07:31:45 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Interesting. I guess I'll have to go through the process of elimination. Thanks.

nomin's avatar nomin (2019-12-23 08:03:08 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer