Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm having a terrible time diagnosing why these bizarre Raw Ethernet II packets are on the LAN side of my firewall. The destination MAC address seems to increment where the source MAC address seems random. Possible IPv6? Netgear SRX5308 firewall connected to netgear GSM7224 switch. Thanks in advance for any assistance.

No.     Time            Delta       Source                Destination           Protocol    Info


120 18:19:33.611085 -0.526987   18:c5:19:e1:d8:7f     33:3a:00:00:7b:43     0x17f9   Ethernet II
133 18:19:35.984456 0.204837    ee:a9:42:09:93:19     b0:26:00:00:07:72     0x42a0   Ethernet II
139 18:19:35.984581 -0.142283   16:32:e7:db:5d:92     b0:26:00:00:07:73     0x5fcb   Ethernet II
200 18:19:43.755275 0.671324    30:7c:db:b6:52:96     33:3a:00:00:7b:4f     0x7e09   Ethernet II
204 18:19:43.776927 -0.607388   89:2d:e1:70:94:13     33:3a:00:00:7b:50     0xe609   Ethernet II
207 18:19:43.127271 -1.269810   ac:00:2b:5b:bf:c2     33:3a:00:00:7b:51     0x2223   Ethernet II
210 18:19:44.421248 0.000363    f2:4e:57:63:25:c5     33:3a:00:00:7b:52     0xaf94   Ethernet II
213 18:19:42.707117 -1.737552   78:b3:db:1a:07:05     33:3a:00:00:7b:53     0x9122   Ethernet II
221 18:19:44.432864 -0.083291   bf:14:41:d2:f4:06     33:3a:00:00:7b:55     0xf2cb   Ethernet II
225 18:19:44.445154 -0.106758   a1:79:17:c6:36:1e     33:3a:00:00:7b:56     0x0f91   Ethernet II
229 18:19:44.516192 -0.071335   ff:cc:0a:be:e3:78     33:3a:00:00:7b:57     0xc4be   Ethernet II
234 18:19:44.539938 -0.083353   b7:b1:f7:df:87:64     33:3a:00:00:7b:58     0x886a   Ethernet II
239 18:19:44.587565 -0.071385   7e:b6:dd:ec:d2:50     33:3a:00:00:7b:59     0xae7e   Ethernet II
243 18:19:44.611372 -0.083332   09:4c:a3:ee:37:c0     33:3a:00:00:7b:5a     0x1db8   Ethernet II
247 18:19:44.633725 -0.096678   8a:8b:af:9a:ab:0d     33:3a:00:00:7b:5b     0x1632   Ethernet II
250 18:19:44.682779 -0.071206   ed:68:36:53:39:f7     33:3a:00:00:7b:5c     0x7792   Ethernet II
275 18:19:45.179043 -0.952591   aa:e9:11:66:3e:6b     b0:26:00:00:07:75     0x64cc   Ethernet II
289 18:19:46.184147 -0.126486   85:78:29:67:e4:09     b0:26:00:00:07:77     0x3801   Ethernet II
363 18:19:49.230270 -0.988196   08:3f:8d:ca:51:f3     b0:26:00:00:07:7d     0x7bd4   Ethernet II
478 18:19:54.613266 -0.001937   b1:98:8a:e9:7a:73     33:3a:00:00:7b:69     0x
share|improve this question
    
Can we get the actual pcap files associated with this traffic? –  womble Aug 7 '11 at 5:48
    
Yeah, or alternatively "tcpdump -s 0 -vvv -XX" output for a couple of packets. –  snap Aug 7 '11 at 5:53
    
The pcap files are better, because they can be loaded into other analysis tools more easily. –  womble Aug 7 '11 at 6:51
    
The funny thing is, none of the source or destination MAC addresses appear to be legitimate. –  joeqwerty Aug 7 '11 at 14:24
    
FSVO "legitimate". Some protocols do weird things with MAC addresses. One of my theories (which would take the pcap files to ascertain) is that these aren't actually Ethernet packets. –  womble Aug 7 '11 at 17:54

1 Answer 1

If it wasn't for the very consistent destination MAC addresses, I'd be inclined to suggest it was some sort of crazy noise -- the random ethertypes is what's doing my head in. Track down the source port of the packets (if you're on a quiet network, you might be able to correlate it with per-port packet counters; on a production network you'll probably just have to mirror each port until you find the right one) and let us know what the device is, and perhaps someone will have more details of what the cause of the trouble is.

share|improve this answer
    

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.