From owner-freebsd-net@FreeBSD.ORG Wed Mar 14 23:57:37 2012 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id E82B71065670 for ; Wed, 14 Mar 2012 23:57:37 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from asmtpout022.mac.com (asmtpout022.mac.com [17.148.16.97]) by mx1.freebsd.org (Postfix) with ESMTP id 5AB3E8FC08 for ; Wed, 14 Mar 2012 23:57:37 +0000 (UTC) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; CHARSET=US-ASCII Received: from cswiger1.apple.com (unknown [17.209.4.71]) by asmtp022.mac.com (Oracle Communications Messaging Server 7u4-23.01 (7.0.4.23.0) 64bit (built Aug 10 2011)) with ESMTPSA id <0M0W007WND3KPL80@asmtp022.mac.com> for freebsd-net@freebsd.org; Wed, 14 Mar 2012 22:57:20 +0000 (GMT) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.6.7498,1.0.260,0.0.0000 definitions=2012-03-14_06:2012-03-14, 2012-03-14, 1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 ipscore=0 suspectscore=0 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=6.0.2-1012030000 definitions=main-1203140252 From: Chuck Swiger In-reply-to: <5E4F49720D0BAD499EE1F01232234BA87438162F95@AVEXMB1.qlogic.org> Date: Wed, 14 Mar 2012 15:57:19 -0700 Message-id: <1AB6F524-B4F4-4718-96C5-DB2951A02D59@mac.com> References: <5E4F49720D0BAD499EE1F01232234BA87438162F95@AVEXMB1.qlogic.org> To: Adarsh Joshi X-Mailer: Apple Mail (2.1084) Cc: "freebsd-net@freebsd.org" Subject: Re: Zero MAC address X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Mar 2012 23:57:38 -0000 On Mar 14, 2012, at 3:32 PM, Adarsh Joshi wrote: > I assigned a 00:00:00:00:00:00 MAC address to one of my interfaces on a machine and tried to ping the peer machine. The ping did go through fine. > > I can the see the request and reply packets on the packet capture. I am wondering if that is legitimate and if not, who is supposed to check that. I mean, the stack or the driver on the sending machine or the receiving machine. > > Basically, I am trying to test a statistics utility which keeps track of packets with invalid MAC addresses. Are the packets with zero MAC addresses be classified as invalid? In theory, no-- 00:00:00 OUI belongs to Xerox, and there is nothing special about an all-zeros MAC. If you see an OUI with the second bit of the first octet set, that would indicate locally managed addresses rather than global or "universally administered" numbering, otherwise you can lookup against OUI data from the IEEE: http://standards.ieee.org/develop/regauth/oui/oui.txt ...and that will let you identify the vendor of the ethernet NIC, SAS/fibre channel controller, etc...or conclude that someone is likely spoofing MAC addresses if you don't find the OUI listed. Maybe that's what you mean by "invalid"? Regards, -- -Chuck