|
Posted by stephen on October 13, 2005, 9:18 pm
If you were Registered and logged in, you could reply and use other advanced thread options
> > I'm a bit worried that the data format used could be interpreted by
> > some
> > equipment as a valid packet, though this would be rare. What I want is
> > some sort of test packet that is universally ignored. The data as it
> > is
> > now would start with an LLC header of "00 00 00". Is this likely to be
> > misinterpreted, or is there something else I can try?
>
> It's very unlikely to be missinterpreted.
>
> http://www.wildpackets.com/support/compendium/ethernet/frame_formats
>
> http://www.ethermanage.com/ethernet/enet-numbers/ieee-lsap-list.html
> http://www.ethermanage.com/ethernet/enet-numbers/cisco-lsap-list.html
> http://www.ethermanage.com/ethernet/descript-troubleshoot.html
>
> Mention a NULL LSAP with the address fields set to
> zero.
>
> Maybe your zero, zero is just the job. You should get the IEEE
> 802.2 doc and check yourself though. You used to be
> able to buy them on-line and download a pdf.
00 is the "null" LSAP, so 00,00 should be OK - i think this can be used as
an 802.2 type "ping".
>
> Here are a few possible workarounds.
>
> Avoid broadcast and m'cast dest MAC.
>
> Could you send a packet with an invalid CRC?
> Then everything would ignore it.
>
> What happens if you send it to your own MAC address?
> Everything else would ignore it, but it might possibly come back to
> you.
it shouldnt - but this is what cisco and various others such as the
Wellfleet / Bay Nortel routers do for a "test" packet.
Also - there is a Ethernet type code 9000 which i think is allocated for
"test" - i have seen this "in the wild" with a sniffer.
>
> Buy a NIC, get its address then destroy it. Use that
> address as the destination address.
>
> Send a 'good' frame eg an ICMP echo request or an ARP request.
>
> Just pick a destination MAC, the chances of
> ever coming into contact with it are rather small.
> Unless:- you sell millions of them in which case send
> me my share:)
>
> Look through the OUI list and pick an unlikely vendor, say
> one that has not yet been taken over and is not too likely to be.
>
> http://www.iana.org/assignments/ethernet-numbers
>
> How about:
>
> 080056 Stanford University
>
> Not likely to be taken over any day soon and not
> too likely to go into the mass production of
> printers, games consoles or refrigerators.
>
> Of course they might sell it.
--
Regards
stephen_hope@xyzworld.com - replace xyz with ntl
| 
NewsGroups 
Yahoo! 
Google 
Windows Live 
del.icio.us 
digg 
Netscape 
XML site map