On Mar 14, 2012, at 3:32 PM, Adarsh Joshi wrote: > I assigned a 00:00:00:00:00:00 MAC address to one of my interfaces on a > machine and tried to ping the peer machine. The ping did go through fine. > > I can the see the request and reply packets on the packet capture. I am > wondering if that is legitimate and if not, who is supposed to check that. I > mean, the stack or the driver on the sending machine or the receiving machine. > > Basically, I am trying to test a statistics utility which keeps track of > packets with invalid MAC addresses. Are the packets with zero MAC addresses > be classified as invalid?
In theory, no-- 00:00:00 OUI belongs to Xerox, and there is nothing special about an all-zeros MAC. If you see an OUI with the second bit of the first octet set, that would indicate locally managed addresses rather than global or "universally administered" numbering, otherwise you can lookup against OUI data from the IEEE: http://standards.ieee.org/develop/regauth/oui/oui.txt ...and that will let you identify the vendor of the ethernet NIC, SAS/fibre channel controller, etc...or conclude that someone is likely spoofing MAC addresses if you don't find the OUI listed. Maybe that's what you mean by "invalid"? Regards, -- -Chuck _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
