On May 7, 2004, at 1:53 PM, Rob Henningsgard wrote:
Actually, I know nothing about Cisco's stuff. Ethereal logged and reported
Cisco management packets, describing them as "STP" (Spanning Tree for
Bridges) protocol. Sadly, I can't cut and paste the lovely, detailed
description of the packet from Ethereal, and I don't have time right now
to transcribe it for all to see.
The header was described as "Logical Link Control", with the fields "DSAP", "IG Bit", "SSAP", "CR Bit", and "Control Field".
OK, that's an 802.2 LLC header - those aren't 802.11 management frames (STP isn't 802.11-specific - it's also used on Ethernet and, I think, Token Ring and perhaps FDDI; it's also not Cisco-specific, it's part of one or more of the IEEE 802.1 specifications - I forget which one(s)).
Looks to me as if Ethereal detected the target MAC as being a "magic cookie", as it created the comment, "spanning-tree-for- bridges" on the expanded information line about that odd-looking MAC, "$01,$80,$C2,$00,$00,$00".
That's a multicast address - I think one of the 802.1 specs specifies a range of multicast addresses used for STP. Ethereal has a file (the "manuf" file) that includes both names for the manufacturer portion of unicast MAC addresses and for various "well-known" multicast addresses, including the spanning tree addresses.
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
