That 01-00-0C-CC-CC-CD multicast destination address is used by Cisco for their Per-VLAN Spanning Tree Plus (PVST+). Here's what I have heard:
802.1Q supports a single spanning tree for all VLANs in the campus network, (unless that has changed). This is sometimes called Mono Spanning Tree or MST. Cisco's ISL supports a spanning tree per VLAN. In a hybrid ISL/802.1Q environment where both MST and PVST are active, switches can become confused. In the past, the only solution was to force ISL to use MST, thus losing the benefits of PVST. To deal with this issue, Cisco developed PVST+, which tunnels PVST Bridge Protocol Data Units (BPDUs) through the 802.1Q MST, thus allowing each VLAN to maintain its own spanning tree. Cisco uses the multicast address 01-00-0C-CC-CC-CD for PVST+. TCPDUMP definitely shouldn't be claiming that they are IPX packets! Priscilla At 09:12 PM 4/3/02, Jonathan Masson wrote: >Has anyone ever these packets on their network before? I am getting about 3 >a sec. I traced the port to a 3500XL but when I do a show mac it isn't >there. I thought it might be cdp so I disabled that but it is still there. >I thought it was wierd. > > > >cisco prefix >00-07-EB (hex) Cisco Systems Inc. >0007EB (base 16) Cisco Systems Inc. > 170 West Tasman Dr. > San Jose CA 95134 > UNITED STATES > >tcpdump output >16:58:26.066273 0:7:eb:f2:62:81 > 1:0:c:cc:cc:cd sap aa ui/C > >>> Unknown IPX Data: (39 bytes) >[000] 00 00 80 00 00 07 EB F2 62 83 00 00 00 00 80 00 ........ b....... >[010] 00 07 EB F2 62 83 80 0D 00 00 14 00 02 00 0F 00 ....b... ........ >[020] 00 00 00 00 02 00 60 ......` > len=39 ________________________ Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=40426&t=40419 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
