Date: Wed, 14 Mar 2012 16:05:34 -0700 From: Adarsh Joshi <adarsh.joshi@qlogic.com> To: Chuck Swiger <cswiger@mac.com> Cc: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org> Subject: RE: Zero MAC address Message-ID: <5E4F49720D0BAD499EE1F01232234BA87438162FAE@AVEXMB1.qlogic.org> In-Reply-To: <1AB6F524-B4F4-4718-96C5-DB2951A02D59@mac.com> References: <5E4F49720D0BAD499EE1F01232234BA87438162F95@AVEXMB1.qlogic.org> <1AB6F524-B4F4-4718-96C5-DB2951A02D59@mac.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Thank you for the quick replies. I am aware of the importance of the second bit. By invalid, I was wondering= if that particular address is reserved or if it has any special meaning or= purpose. So in theory, I cannot classify it as an invalid MAC address on my packet s= tatistics utility. On a side thought, can an incoming packet be classified as "invalid MAC add= ress" if it has the same MAC address of the host? Thanks again Adarsh -----Original Message----- From: Chuck Swiger [mailto:cswiger@mac.com] Sent: Wednesday, March 14, 2012 3:57 PM To: Adarsh Joshi Cc: freebsd-net@freebsd.org Subject: Re: Zero MAC address On Mar 14, 2012, at 3:32 PM, Adarsh Joshi wrote: > I assigned a 00:00:00:00:00:00 MAC address to one of my interfaces on a m= achine and tried to ping the peer machine. The ping did go through fine. > > I can the see the request and reply packets on the packet capture. I am w= ondering if that is legitimate and if not, who is supposed to check that. I= mean, the stack or the driver on the sending machine or the receiving mach= ine. > > Basically, I am trying to test a statistics utility which keeps track of = packets with invalid MAC addresses. Are the packets with zero MAC addresse= s be classified as invalid? In theory, no-- 00:00:00 OUI belongs to Xerox, and there is nothing special= about an all-zeros MAC. If you see an OUI with the second bit of the first octet set, that would in= dicate locally managed addresses rather than global or "universally adminis= tered" numbering, otherwise you can lookup against OUI data from the IEEE: http://standards.ieee.org/develop/regauth/oui/oui.txt ...and that will let you identify the vendor of the ethernet NIC, SAS/fibre= channel controller, etc...or conclude that someone is likely spoofing MAC = addresses if you don't find the OUI listed. Maybe that's what you mean by "invalid"? Regards, -- -Chuck This message and any attached documents contain information from QLogic Cor= poration or its wholly-owned subsidiaries that may be confidential. If you = are not the intended recipient, you may not read, copy, distribute, or use = this information. If you have received this transmission in error, please n= otify the sender immediately by reply e-mail and then delete this message.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5E4F49720D0BAD499EE1F01232234BA87438162FAE>