From owner-freebsd-net@FreeBSD.ORG Wed Mar 14 23:05:39 2012 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id AA07B106564A for ; Wed, 14 Mar 2012 23:05:39 +0000 (UTC) (envelope-from adarsh.joshi@qlogic.com) Received: from tx2outboundpool.messaging.microsoft.com (tx2ehsobe001.messaging.microsoft.com [65.55.88.11]) by mx1.freebsd.org (Postfix) with ESMTP id 60C088FC18 for ; Wed, 14 Mar 2012 23:05:39 +0000 (UTC) Received: from mail82-tx2-R.bigfish.com (10.9.14.250) by TX2EHSOBE008.bigfish.com (10.9.40.28) with Microsoft SMTP Server id 14.1.225.23; Wed, 14 Mar 2012 23:05:40 +0000 Received: from mail82-tx2 (localhost [127.0.0.1]) by mail82-tx2-R.bigfish.com (Postfix) with ESMTP id 89CCA1401A8; Wed, 14 Mar 2012 23:05:39 +0000 (UTC) X-SpamScore: -16 X-BigFish: VPS-16(zz9371I542M1432N98dK111aIzz1202hzz8275dhz2fh2a8h668h839h944hd25h) X-Forefront-Antispam-Report: CIP:198.70.193.61; KIP:(null); UIP:(null); IPV:NLI; H:avexcashub1.qlogic.com; RD:avexcashub1.qlogic.com; EFVD:NLI Received-SPF: pass (mail82-tx2: domain of qlogic.com designates 198.70.193.61 as permitted sender) client-ip=198.70.193.61; envelope-from=adarsh.joshi@qlogic.com; helo=avexcashub1.qlogic.com ; 1.qlogic.com ; Received: from mail82-tx2 (localhost.localdomain [127.0.0.1]) by mail82-tx2 (MessageSwitch) id 1331766337423717_25358; Wed, 14 Mar 2012 23:05:37 +0000 (UTC) Received: from TX2EHSMHS024.bigfish.com (unknown [10.9.14.238]) by mail82-tx2.bigfish.com (Postfix) with ESMTP id 58F19240045; Wed, 14 Mar 2012 23:05:37 +0000 (UTC) Received: from avexcashub1.qlogic.com (198.70.193.61) by TX2EHSMHS024.bigfish.com (10.9.99.124) with Microsoft SMTP Server (TLS) id 14.1.225.23; Wed, 14 Mar 2012 23:05:37 +0000 Received: from avexmb1.qlogic.org ([fe80::9545:3a4f:c131:467d]) by avexcashub1.qlogic.org ([::1]) with mapi; Wed, 14 Mar 2012 16:05:35 -0700 From: Adarsh Joshi To: Chuck Swiger Date: Wed, 14 Mar 2012 16:05:34 -0700 Thread-Topic: Zero MAC address Thread-Index: Ac0CNdhPKkrowf3TTCi+ZymjbZgh8QAADyEQ Message-ID: <5E4F49720D0BAD499EE1F01232234BA87438162FAE@AVEXMB1.qlogic.org> References: <5E4F49720D0BAD499EE1F01232234BA87438162F95@AVEXMB1.qlogic.org> <1AB6F524-B4F4-4718-96C5-DB2951A02D59@mac.com> In-Reply-To: <1AB6F524-B4F4-4718-96C5-DB2951A02D59@mac.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: qlogic.com Cc: "freebsd-net@freebsd.org" Subject: RE: Zero MAC address X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Mar 2012 23:05:39 -0000 Thank you for the quick replies. I am aware of the importance of the second bit. By invalid, I was wondering= if that particular address is reserved or if it has any special meaning or= purpose. So in theory, I cannot classify it as an invalid MAC address on my packet s= tatistics utility. On a side thought, can an incoming packet be classified as "invalid MAC add= ress" if it has the same MAC address of the host? Thanks again Adarsh -----Original Message----- From: Chuck Swiger [mailto:cswiger@mac.com] Sent: Wednesday, March 14, 2012 3:57 PM To: Adarsh Joshi Cc: freebsd-net@freebsd.org Subject: Re: Zero MAC address On Mar 14, 2012, at 3:32 PM, Adarsh Joshi wrote: > I assigned a 00:00:00:00:00:00 MAC address to one of my interfaces on a m= achine and tried to ping the peer machine. The ping did go through fine. > > I can the see the request and reply packets on the packet capture. I am w= ondering if that is legitimate and if not, who is supposed to check that. I= mean, the stack or the driver on the sending machine or the receiving mach= ine. > > Basically, I am trying to test a statistics utility which keeps track of = packets with invalid MAC addresses. Are the packets with zero MAC addresse= s be classified as invalid? In theory, no-- 00:00:00 OUI belongs to Xerox, and there is nothing special= about an all-zeros MAC. If you see an OUI with the second bit of the first octet set, that would in= dicate locally managed addresses rather than global or "universally adminis= tered" numbering, otherwise you can lookup against OUI data from the IEEE: http://standards.ieee.org/develop/regauth/oui/oui.txt ...and that will let you identify the vendor of the ethernet NIC, SAS/fibre= channel controller, etc...or conclude that someone is likely spoofing MAC = addresses if you don't find the OUI listed. Maybe that's what you mean by "invalid"? Regards, -- -Chuck This message and any attached documents contain information from QLogic Cor= poration or its wholly-owned subsidiaries that may be confidential. If you = are not the intended recipient, you may not read, copy, distribute, or use = this information. If you have received this transmission in error, please n= otify the sender immediately by reply e-mail and then delete this message.