Ask Your Question

Ethernet II frames with random MAC destinations?

asked 2019-12-23 07:11:44 +0000

nomin gravatar image

I am monitoring a home network and I see periodic Ethernet II frames sent from 00:00:00:00:00:00 to random MACs xx:xx:xx:xx:00:00. For example:

image description

Frame 96694: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 1a:88:51:05:00:00 (1a:88:51:05:00:00)
    Destination: 1a:88:51:05:00:00 (1a:88:51:05:00:00)
    Source: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Type: Unknown (0x0000)
Data (46 bytes)
    Data: 000000000000000000000000000000000000000000000000…
    [Length: 46]

The last 4 of dst is always 00:00. The type is always Unknown (0x0000). The data is always 46 bytes of zeroes. I have no idea what could be sending this. It is a typical home network. Amazon Fire Stick, LG TV, Playstation, some Android phones, some Android tablets, some Windows laptops and a Windows desktop (what I'm using Wireshark on and it's connected to the Linksys router via ethernet cable).

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted

answered 2019-12-23 07:31:45 +0000

Jaap gravatar image

That would be indicative of a failing network device. The frame data seems to suggest that a (residual?) 32 bit word is (assumed to be) present in a frame descriptor block in the network driver. The networking hardware makes this a valid length Ethernet frame by padding with zeros. Disclaimer: this are no more than educated guesses, but fitting the (limited) evidence.

To be able to find this device you would have to backtrack through the network ports, looking for this type of frames.

edit flag offensive delete link more


Interesting. I guess I'll have to go through the process of elimination. Thanks.

nomin gravatar imagenomin ( 2019-12-23 08:03:08 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-12-23 07:11:44 +0000

Seen: 575 times

Last updated: Dec 23 '19