|
Okay, I can't work on my Z more during the week cause we keep seeing packets like these on our network. Sometimes working with a networking company sucks cause people test new stuff on the network or generate some funky ass packets like these two. In general a router should drop these as they are *VERY* invalid and screwed.. But out crappy routers decide to forward the packet out every interface. These also lock up all Netapp boxes... Sweet.. it's nice having to reboot about 2TB or drivespace and pray that it's in good shape..
Packet capture from Snoop, from Monday 06/11/01
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 1 arrived at 15:40:45.19
ETHER: Packet size = 60 bytes
ETHER: Destination = ff:ff:ff:ff:ff:ff, (broadcast)
ETHER: Source = 0:30:c1:c3:0:30,
ETHER: Ethertype = 0806 (ARP)
ETHER:
ARP: ----- ARP/RARP Frame -----
ARP:
ARP: Hardware type = 61567
ARP: Protocol type = 0800 (IP)
ARP: Length of hardware address = 2 bytes
ARP: Length of protocol address = 5 bytes
ARP: Opcode 1 (ARP Request)
ARP:
0: ffff ffff ffff 0030 c1c3 0030 0806 f07f .......0...0....
16: 0800 0205 0001 0005 c1c3 0035 a990 0000 ...........5....
32: 0000 f03f 0000 0000 3126 0000 0000 0000 ...?....1&......
48: 0000 0000 0000 0000 0000 a991 ............
------------------------------
Packet capture from Snoop, from Tuesday 06/12/01
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 1 arrived at 15:17:29.08
ETHER: Packet size = 60 bytes
ETHER: Destination = ff:ff:ff:ff:ff:ff, (broadcast)
ETHER: Source = 0:10:a4:e0:0:10,
ETHER: Ethertype = 0806 (ARP)
ETHER:
ARP: ----- ARP/RARP Frame -----
ARP:
ARP: Hardware type = 61119
ARP: Protocol type = 0800 (IP)
ARP: Length of hardware address = 68 bytes
ARP: Length of protocol address = 1 bytes
ARP: Opcode 1 (ARP Request)
ARP:
0: ffff ffff ffff 0010 a4e0 0010 0806 eebf ................
16: 0800 4401 0001 0615 a4e0 eeff a990 0000 ..D.............
32: 0000 e0ff 0000 a091 3101 0111 0022 0111 ........1...."..
48: 318d 0000 00d2 0083 2045 4647 1....... EFG
- John 
|
