Strange network frames

matiasquestions · 08-06-2008, 05:13 AM

Hi,

I'm seeing in my network a lot of really strange frames. I can't find the origin host, and I'm not even sure if it's a host generating the traffic or a switch.Did anyone ever see something similar?

12:08:20.991335 0a:00:01:46:ff:ff > 00:00:00:00:00:00, ethertype Unknown (0xffff), length 60:
0x0000: ffff 0030 4890 0798 0806 0001 0800 0604 ...0H...........
0x0010: 0001 0030 4890 0798 0a00 0146 0000 0000 ...0H......F....
0x0020: 0000 0000 0000 0000 0000 0000 0000 ..............

Thanks a lot.

unSpawn · 08-07-2008, 07:06 PM

More network and topology, host, HW and pcap (upload to some free hoster?) details welcome.

matiasquestions · 08-11-2008, 02:30 AM

I've put a tcpdump showing the problem here:

http://byosoft.dyndns.org/captura.cap

You can see the strange packets for example, in No1, 5 and 6.

Thanks for your help.

junpa · 08-11-2008, 02:52 AM

matiasquestions,

that link is down.
You can upload your capture to this pastebin and then post the link to it as a reply to this thread.

matiasquestions · 08-11-2008, 03:19 AM

Couldn't upload the file there, as this is a binary one.

I've managed to put it here instead:

http://www.2shared.com/file/3742233/...e/captura.html

Thanks for your help!!

junpa · 08-11-2008, 08:59 AM

matiasquestions,

looks like an encapsulated ARP request packet to me.

0806 - ARP Packet (ethernet.h)

SRC MAC - 00:30:48:90:07:98
SRC IP - 10.0.1.70

The only problem is the destination mac and destination ip are both zero'd

could be a result of crafted packets or some driver issue....

you have anymore information about your LAN setup?