On 1/31/2018 5:14 PM, Hante Meuleman wrote:
It is an 802.2 frame, more specifically a LLC XID frames. So why it exists?
And more over, why would we crash as an result? Decoding info can be found
here:
https://www.cisco.com/c/en/us/support/docs/ibm-technologies/logical-link-control-llc/12247-45.html#con3
The frame was likely sent by the stack from remote site PC, should be
possible to capture with tcpdump.
I've seen these frames before, but don’t know what they are for. The frame
appears to be correctly encoded. The ethertype, is not a type, but a len
field. The only protocol with such a short len allowed is llc, see also
Could it be related to the fact that the interface is put in a bridge
and hence the device is put in promiscuous mode? Anyway, I did not read
anything about a firmware crash. Just that clients could not associate.
Regards,
Arend
