ethernet strangeness - help?

George Toft plug-discuss@lists.PLUG.phoenix.az.us
Sat, 30 Jun 2001 12:09:31 -0700


Greetings,

I was monitoring my LAN using Ethereal and came across this:

==================================================================
+ Frame 26 (60 on wire, 60 captured)
- IEEE 802.3 Ethernet
    Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
    Source: 00:48:54:72:73:57 (00:48:54:72:73:57)
    Length: 64
- Logical-Link Control
    DSAP: NULL LSAP (0x00)
    IG Bit: Individual
    SSAP: NULL LSAP (0x00)
    CR Bit: Command
  + Control field: I, N(R) = 0, N(S) = 0 (0x0000)
 Data (42 bytes)
==================================================================

These packets arrive every 171.8295 seconds


The MACs on my LAN are:
donelle - 00:40:F4:05:C9:FE
sparc - 08:00:20:13:0B:D9
router (private) - 00:04:5A:08:1F:59
router (public) - 00:E0:98:06:D8:DE


Crude picture of my setup

Qwest        eth0    eth1
Digital ------- router -----SWITCH----- sparc (Solaris)
Gateway         (Linux)          +===== donelle (Win98)

----- - 10BaseT
===== - 100BaseT


My question - why is this ethernet frame getting onto my LAN?  Is the
Linux Router passing on LLC info from Qwest?  Where is it coming from?

Thanks in advance.

George