Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

While trying to fix a problem with intermittently losing internet connection on a machine with a wireless connection to a router, I ran tcpdump and noticed packets with "Unknown SSAP" and "Unknown DSAP" errors coming at a rate of a few per second.

20:27:21.703178 00:24:a5:af:24:f6 (oui Unknown) Unknown SSAP 0xde > 1c:65:9d:48:38:95 (oui Unknown) Unknown DSAP 0xe2 Information, send seq 0, rcv seq 16, Flags [Response], length 171
20:27:21.724726 00:24:a5:af:24:f6 (oui Unknown) Unknown SSAP 0xde > 1c:65:9d:48:38:95 (oui Unknown) Unknown DSAP 0xe2 Information, send seq 0, rcv seq 16, Flags [Response], length 104
20:27:21.746449 00:24:a5:af:24:f6 (oui Unknown) Unknown SSAP 0xde > 1c:65:9d:48:38:95 (oui Unknown) Unknown DSAP 0xe4 Information, send seq 0, rcv seq 16, Flags [Response], length 88
20:27:21.970963 00:24:a5:af:24:f6 (oui Unknown) Unknown SSAP 0xde > 1c:65:9d:48:38:95 (oui Unknown) Unknown DSAP 0xe8 Information, send seq 0, rcv seq 16, Flags [Response], length 76
20:27:22.016565 00:24:a5:af:24:f6 (oui Unknown) Unknown SSAP 0xde > 1c:65:9d:48:38:95 (oui Unknown) Unknown DSAP 0xea Information, send seq 0, rcv seq 16, Flags [Response], length 88
20:27:22.038471 00:24:a5:af:24:f6 (oui Unknown) Unknown SSAP 0xde > 1c:65:9d:48:38:95 (oui Unknown) Unknown DSAP 0xea Information, send seq 0, rcv seq 16, Flags [Response], length 171

What does the "Unknown SSAP" and "Unknown DSAP" mean, and does it indicate a problem?

share|improve this question
    
Have you been able to solve your initial problem? –  user1202136 May 26 at 20:42
add comment

2 Answers 2

One thing they could mean that the frames being sent have 802.2 headers following the link-layer header (which is true of all 802.11 data frames, and true of Ethernet frames where the type/length field has a length rather than an Ethernet type), and that the source and destination Service Access Points in those headers have values that tcpdump doesn't know about. (Wireshark doesn't know about them, either.)

The IEEE listing of Service Access Point values shows no public assignment for 0xde, 0xe2, 0xe4, 0xe8, or 0xea.

They could also mean that, for some reason, tcpdump isn't properly dissecting the packet data, or that it's encrypted at the link layer (i.e., WEP or WPA/WPA2 frames) and tcpdump isn't recognizing it as being encrypted.

What version of what OS is the machine on which you ran tcpdump running (if it's Linux, "version" here means "kernel version", but the distribution and distribution version number would also be useful), what version of tcpdump and libpcap are you using (what does tcpdump -h print?), and what type of device are you capturing on (802.11 or Ethernet, and who manufactures it and what type of device from that manufacturer is it?)?

The "OUI unknown" means it didn't find an organization with the OUI 00:24:a5, which are the first 3 octets of the MAC address of the sending machine, and didn't find an organization with the OUI 1c:65:9d, which are the first 3 octets of the MAC address of the receiving machine.

The IEEE database says 00:24:a5 is for "Buffalo, Inc" (who are located in Japan, not Buffalo, New York, USA) and 1c:65:9d is for "Liteon Technology Corporation" in Taiwan.

share|improve this answer
add comment

Presumably, DSAP and SSAP are used on 802.3 frames to identify higher-level protocols carried on the frame (not the same as Ethernet).

share|improve this answer
    
SSAP and DSAP are used with 802.2, not 802.3 (see en.wikipedia.org/wiki/IEEE_802.2) –  ott-- Nov 10 '11 at 1:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.