Strange ethrenet frame

Hi all,

I have a stange behavior when listening traffic on a NO CARRIER interface.(i know it's stupid, but i'm doing tests ...)

I try to reach a connected host and I listen on interface output with tcpdump and some traffic seem so be dumped of an "unknown ethertype". I have a very bad ethenet link connected to this interface, that makes it in NO CARRIER state. When all is right, packet dumped are ARP one. So i have many question about the bahaviour in order to validate my test. Did it possible to send traffic on a no carrier interface (that did not detect link activity) ? Did the dumped traffic is really sent or is it just traffic that "seem" to be sent (software garbage not physical send)? Did that mean that some ethernet traffic can go out of my (no carrier) ethernet card ?

I'm douin my tests with a pcn device and a PC runnning FreeBSD 5.3.

Thx for your answers

Reply to
Mr Lex
Loading thread data ...

No answer, no idea ? Nobody could help me solving my problem ? I'm blocked ....

Mr Lex wrote:

Reply to
Mr Lex

Mr Lex wrote in part:

This will depend entirely on the hardware (etherchip) and device driver software. A high error rate (bad cabling) can ersult in all sort of anomalies, some of which might appear occasionally to be semi-valid.

-- Robert

Reply to
Robert Redelmeier

It isn't an easy question, especially without knowing the exact hardware and software in use.

It is possible that tcpdump can see data sent to an interface, but not actually transmitted.

It is possible that it is up long enough for data to be received.

Post the actual data from one packet and you will likely get more answers.

-- glen

Reply to
glen herrmannsfeldt

Hi all,

Thanks for answers Here is the dump of the traffic :

%tcpdump -i pcn2 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on pcn2, link-type EN10MB (Ethernet), capture size 96 bytes

23:09:18.851391 00:00:01:02:5e:8c > 45:c0:00:1c:ca:2c, ethertype Unknown (0xac14), length 28: 0x0000: 0452 e000 0001 1164 ee9b 0000 0000 .R.....d...... 23:09:20.768080 00:00:01:02:ca:2e > 46:00:00:20:ca:3e, ethertype Unknown (0xac14), length 32: 0x0000: 0452 e000 0004 9404 0000 1600 09fb e000 .R.............. 0x0010: 0004 .. 23:09:23.965991 00:00:01:02:ca:20 > 46:00:00:20:ca:4e, ethertype Unknown (0xac14), length 32: 0x0000: 0452 e000 0002 9404 0000 1600 09fd e000 .R.............. 0x0010: 0002

And the status of my interface. %ifconfig pcn2 pcn2: flags=128b43 mtu 1500 ether 00:d0:1c:xx:xx:xx media: Ethernet 100baseTX status: no carrier

This traffic is generated by ARP request on the interface (as i can see when all is right). But MAC adresses are nor my device one nor broadcast one... A stange point is the similarity between all frames...

Thanks for your help, i appreciate.

Reply to
Mr Lex

Does anyone have an idea ? Have Someone ever see this type of traffic ?

Lex

Mr Lex wrote:

Reply to
Mr Lex

(snip)

I believe that 45:c0 is a common beginning of an IP header.

Why you would see this in the MAC field, I don't know. Showing a hex dump of a few whole packets would help.

-- glen

Reply to
glen herrmannsfeldt

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.