Announcements

For the latest on our response to Coronavirus (COVID-19), click here.

Tutor

 • 

6 Messages

Thu, Apr 25, 2019 7:24 AM

Pace 5268AC: Why does it broadcast ethernet frames type == 0x7373 (unknown type) every second?

The ethernet proto is 0x7373, which is not known. The last octet of the Pace's ethernet address is actually 0x55, although in these broadcast frames, it's 0x5f.

 

Frame 1: 118 bytes on wire (944 bits), 118 bytes captured (944 bits) on interface 0
Interface id: 0 (enp3s0)
Encapsulation type: Ethernet (1)
Arrival Time: Apr 25, 2019 00:04:52.066738554 PDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1556175892.066738554 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 118 bytes (944 bits)
Capture Length: 118 bytes (944 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:data]
[Coloring Rule Name: Broadcast]
[Coloring Rule String: eth[0] & 1]
Ethernet II, Src: 2Wire_f8:6c:5f (f8:18:97:f8:6c:5f), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Source: 2Wire_f8:6c:5f (f8:18:97:f8:6c:5f)
Address: 2Wire_f8:6c:5f (f8:18:97:f8:6c:5f)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: Unknown (0x7373)
Data (104 bytes)
Data: 12110000004066afa39455de2b077573071d136aa7917e30…
[Length: 104]

Responses

egburr

Tutor

 • 

16 Messages

2 months ago

I am seeing this exact issue on my ARRIS BGW210-700 (AT&T fiber). The modem/router/access point is acting as a DHCP client in my internal LAN to my DHCP server, using an extra MAC address that it does not advertise in its configuration/status panels.

It is sending out these broadcasts, and I have yet to decode that data payload. I'm really curious what it's looking for.

It is also sending out Spanning Tree (for bridging) packets and occasionally an IPv4 IGMP Membership Query and an IPv6 ICMP Multicast Listener Query. None of these have any actual data, but they still don't belong on my network coming from this device that shouldn't even be there.

AT&T TV – All Your Entertainment In One Spot.  Learn more…