On Mon, Oct 13, 2003 at 04:29:53PM -0700, Scott Douglass wrote: > It seems that there are hundreds of "Association Requests" per second > taking place between two devices, neither of which shows up as an access > point in netstumbler... > > The traffic is always the same: source address 8f:a4:08:00:45:00 > destination address 30:81:00:02:2d:49 > > Does this make any sense? What is this traffic?
Without seeing the full packet data, it is a bit difficult to say what that is, but 08 00 45 00 would be Ethernet proto for IP (08 00) and beginning of IPv4 header (45 00), so I would guess that these are either encapsulation or decapsulation errors in sender or sniffer.. IEEE 802.11 management frames have DA=addr1 and SA=addr2, so that could be an Ethernet header with dest=??:??:??:??:30:81, src=00:02:2d:49:8f:a4, proto 08:00 (IP). 00:02:2d is Agere's MAC addr prefix, so this interpretation of the address sounds quite probable for a wireless network. -- Jouni Malinen PGP id EFC895FA -- general wireless list, a bawug thing <http://www.bawug.org/> [un]subscribe: http://lists.bawug.org/mailman/listinfo/wireless
