On Jan 23, 2012 12:10 PM, "Pandu Poluan" <pa...@poluan.info> wrote: > > > On Jan 23, 2012 12:57 AM, "Grant" <emailgr...@gmail.com> wrote: > > > > ----- >8 snip > > > > > Also the MAC indicated in the firewall log is 14 blocks long and the > > local system in question has a MAC address 6 blocks long according to > > ifconfig, but the 6 blocks from ifconfig do match 6 of the blocks > > reported by the firewall. > > > > Does this make sense to anyone? > > > > It's (source MAC):(dest MAC):(payload type) > > (payload type) is usually 08:00 unless you're using SNAP/LLC > > Rgds,
Oops, sorry, it's the other way around (dest):(source):(type). It's the representation of the first 14 octets of the Ethernet frame. Rgds, On Jan 23, 2012 12:10 PM, "Pandu Poluan" <pa...@poluan.info> wrote: > > On Jan 23, 2012 12:57 AM, "Grant" <emailgr...@gmail.com> wrote: > > > > ----- >8 snip > > > > > Also the MAC indicated in the firewall log is 14 blocks long and the > > local system in question has a MAC address 6 blocks long according to > > ifconfig, but the 6 blocks from ifconfig do match 6 of the blocks > > reported by the firewall. > > > > Does this make sense to anyone? > > > > It's (source MAC):(dest MAC):(payload type) > > (payload type) is usually 08:00 unless you're using SNAP/LLC > > Rgds, >
