Ask Your Question

Why has the 8 in the MAC address in the capture window been replaced with an a?

asked 2019-09-12 11:03:59 +0000

tommytriger gravatar image

updated 2019-09-12 21:40:11 +0000

Guy Harris gravatar image

Why has the 8 in the MAC address in the capture window been replaced with an a? ie 48 has become 4a

* Packets window **

767 194.341125  fe80::4a4a:e9ff:fec8:6012   ff02::1:2   DHCPv6 .............

* Inspection window *

Frame 767: 116 bytes on wire (928 bits), 116 bytes captured (928 bits) on interface 0
Ethernet II, Src: HewlettP_c8:60:12 (48:4a:e9:c8:60:12), Dst: IPv6mcast_01:00:02 (33:33:00:01:00:02)
    Destination: IPv6mcast_01:00:02 (33:33:00:01:00:02)
    Source: HewlettP_c8:60:12 (48:4a:e9:c8:60:12) ****THIS IS THE TRUE MAC****
    Type: IPv6 (0x86dd)
Internet Protocol Version 6, Src: fe80::4a4a:e9ff:fec8:6012, Dst: ff02::1:2
User Datagram Protocol, Src Port: 546, Dst Port: 547

Thanks in advance for any light on this.

edit retag flag offensive close merge delete


The "Packets window" information displays the IPv6 addresses used for the DHCPv6 packet, not the MAC address.

The source address is a link local addresses (FE80::/10), and seems to be derived in some form from the MAC address but I'm not sure of the rules for creating such an address for a DHCPv6 client request.

grahamb gravatar imagegrahamb ( 2019-09-12 11:22:33 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2019-09-12 13:08:16 +0000

Jaap gravatar image

updated 2019-09-12 13:09:40 +0000

This is IPv6 EUI-64 addressing, see here and here.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-09-12 11:03:59 +0000

Seen: 345 times

Last updated: Sep 12 '19