At 02:55 PM 6/15/01, Michael Cohen wrote:
>Has anyone ever heard of network traffic that's sourced from a multicast
>ethernet address? I've seen error messages on a Catalyst 4000 that reads:
>
>%SYS-4-P2_WARN- 1/Invalid traffic from multicast source address
>45-00-05-dc-73-a6 on port 1/1
>
>I know that address isn't a multicast address but it's not registered to any
>Ethernet vendor codes either.
It is a group (multicast) address, which, of course, should never happen
with source addresses. The least significant bit of the first byte of the
source address is a one, which means group address.
The really odd thing is that it looks an awful lot like an IPv4 header
which almost always starts with 45 00. Version = 4. Length of the header is
5 32-bit words. No type of service or precedence bits are set. Could this
be a bug causing the sender or recipient to offset bytes somehow?
Another thought: Do you use source-route bridging? With Token Ring SRB, the
first bit of a source address being a one means that source routing
information is present in the frame.
Do you know what is out port 1/1? You could check its status.
Priscilla
>Cisco says this is probably from a traffic
>generator (like SmartBits) but I don't think that's being run anywhere. Has
>anybody seen this MAC address or something like it?
>
>Thanks,
>
>-Michael Cohen
________________________
Priscilla Oppenheimer
http://www.priscilla.com
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=8757&t=8746
--------------------------------------------------
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
