The router should get the MAC address by ARPing. Try to capture the ARPs.
If the router is fast-switching, then you wouldn't catch the ARPs unless
you clear the ARP table on the router first, (which it sounds like you
can't do since you don't have access to the router.) But this may not be a
problem since fast switching is not the default when the ingress and egress
ports are the same as you describe.
Priscilla
At 12:38 PM 3/25/01, Janne Kettunen wrote:
>First. Thank you very much answering my question.
>
>Let me clarify some background about this MAC-address case.
>
>We have many different IP-subnets at same side of router.
>
>Please don't ask me why, it's too long story to tell here :-)
>
>Some of traffic which goes to router and back is targeted at
>layer-2 to this 00:00:00:00:00:01 ethernet address. Still Layer-3
>destination address vary depending targeted IP-host. Problem is that our
>Layer-2 switches pass through these 00:00:00:00:00:01 frames even Layer-3
>(IP) hosts are in other parts of our Layer-2 switched network.
>
>Example:
>
>Source: IP-HostA 10.65.10.1/16 -> Destination: IP-HostB 10.100.100.10/16
>
>Packet goes to Default router as it should (10.65.0.1) and leaves from
>same router interface to other network.
>
>BUT when it leaves router, MAC-Destination address is sometimes this
>strange 00:00:00:00:01. And this is Unicast packet from/to Telnet or POP3
>services (for example).
>
>Source and Destination IP-hosts are not same pair ie. they may be
>whatever IP-hosts in whatever different subnets.
>
>This problem appears in traffic to any direction in any subnets in any
>OS-system type. I think our router is doing something strange, but
>because I can't get it's configuration I can't tell you more details from
>there at the moment (It's Cisco router).
>
>That's why I'm interested to know something about this MAC-address.
>
>PS. We have also DECnet,IPX and LAT traffic in our network, but these
>problem packets are definitely IP traffic.
>
>--
>Regards Janne Kettunen
>CCNA, CFFE
>
>_________________________________
>FAQ, list archives, and subscription info:
>http://www.groupstudy.com/list/cisco.html
>Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
________________________
Priscilla Oppenheimer
http://www.priscilla.com
_________________________________
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
