I've got an ethernet driver I'm modifying that sends out a test packet when it starts to get around a hardware bug. There is no need to ever get a reply, it's sent only to kickstart things.
I'm a bit worried that the data format used could be interpreted by some equipment as a valid packet, though this would be rare. What I want is some sort of test packet that is universally ignored. The data as it is now would start with an LLC header of "00 00 00". Is this likely to be misinterpreted, or is there something else I can try?
-- Darin Johnson
Didn't find your answer? Ask the community — no account required.
A
anybody43
It's very unlikely to be missinterpreted.
formatting link
formatting link
Mention a NULL LSAP with the address fields set to zero.
Maybe your zero, zero is just the job. You should get the IEEE
802.2 doc and check yourself though. You used to be able to buy them on-line and download a pdf.
Here are a few possible workarounds.
Avoid broadcast and m'cast dest MAC.
Could you send a packet with an invalid CRC? Then everything would ignore it.
What happens if you send it to your own MAC address? Everything else would ignore it, but it might possibly come back to you.
Buy a NIC, get its address then destroy it. Use that address as the destination address.
Send a 'good' frame eg an ICMP echo request or an ARP request.
Just pick a destination MAC, the chances of ever coming into contact with it are rather small. Unless:- you sell millions of them in which case send me my share:)
Look through the OUI list and pick an unlikely vendor, say one that has not yet been taken over and is not too likely to be.
formatting link
How about:
080056 Stanford University
Not likely to be taken over any day soon and not too likely to go into the mass production of printers, games consoles or refrigerators.
Of course they might sell it.
N
News Me
[snip]
Rather than hijacking a globally administered MAC address, use a locally administered one. The second bit of the most-significant byte of the MAC is the local/global flag (1 = local, 0 = global). The first bit of the most-significant byte is the multicast/unicast bit (1 = multicast, 0 = unicast), so the second digit MUST be even if you want to prevent switches from possibly forwarding your packet. So as long as the second digit of the OUI is one of {2,6,A,E} you should be OK. E.g.,
02-00-00-00-00-01.
NM
S
stephen
00 is the "null" LSAP, so 00,00 should be OK - i think this can be used as an 802.2 type "ping".
it shouldnt - but this is what cisco and various others such as the Wellfleet / Bay Nortel routers do for a "test" packet.
Also - there is a Ethernet type code 9000 which i think is allocated for "test" - i have seen this "in the wild" with a sniffer.
J
jameshanley39
You should get the IEEE
802 group stuff specs are currently free (this is mentioned on charles spurgeon's website)
formatting link
Join the Discussion
Have something to add? Share your thoughts — no account required.
Didn't find your answer?
Ask the community — no account required
Report Content
You are reporting this content to the moderators. They will look at it
ASAP.