strange MACs in tcpdump output

From: Alexander Vasenin aka BlackSir (blacksir_at_number.ru)
Date: 07/16/04

  • Next message: Motonori Shindo: "Re: strange MACs in tcpdump output" 
    To: <freebsd-net@freebsd.org>
Date: Fri, 16 Jul 2004 21:11:56 +0400

    What is the strange MACs in braces in the following output, and why on some lines it exist while on others - is not. I've checked tcpdump(8) and arp(4) and found nothing about this...

    [root@*] tcpdump -envvvi fxp2 arp and not ether host 0:60:b0:3c:92:86
    tcpdump: listening on fxp2
    19:53:38.727058 0:5:5d:25:ce:3e ff:ff:ff:ff:ff:ff 0806 60: arp who-has 192.168.254.1 (fe:1:0:0:cc:88) tell 192.168.254.253
                      ^^^source ^^^target ^^^???
    Real MAC of 192.168.254.1 is 0:60:b0:3c:92:86

    19:54:01.544218 0:20:ed:85:6a:5c ff:ff:ff:ff:ff:ff 0806 60: arp who-has 192.168.198.1 tell 192.168.198.25

    19:54:02.181343 0:d0:b7:a9:a4:3a ff:ff:ff:ff:ff:ff 0806 60: arp who-has 192.168.198.1 tell 192.168.198.11

    19:54:18.503453 0:c0:49:cc:c1:2 ff:ff:ff:ff:ff:ff 0806 60: arp who-has 192.168.208.65 (0:60:b0:3c:92:86) tell 192.168.208.75
    Real MAC of 192.168.208.65 is 0:60:b0:3c:92:86

    20:10:25.121986 0:5:5d:ed:6d:68 ff:ff:ff:ff:ff:ff 0806 60: arp who-has 192.168.254.1 (5d:ed:6d:68:c0:a8) tell 192.168.254.252
                                                                                           ^^^???
    What is it? MAC in braces is like src MAC 'shifted' by 16bits???

    Alexander Vasenin aka BlackSir

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Motonori Shindo: "Re: strange MACs in tcpdump output"