00:00 Source Address 00:00 Destination Address 0x0000 Protocol 342 length

asked 2019-02-01 17:23:40 +0000

Avaorgoune
1 ●1 ●1 ●1

Our network is being flooded by these types of packets. I have searched for 00:00:00:00:00:00 mac on all the switches to see if there was a single or multiple devices causing this issue. I believe it is a similar issue to the one below. Anyone have any suggestions of where to start?

https://osqa-ask.wireshark.org/questi...

edit retag flag offensive close merge delete

Comments

"I have searched for 00:00:00:00:00:00 mac on all the switches...", but did you find any?

Jaap ( 2019-02-01 19:44:51 +0000 )edit

No, I did not find anything in any of the mac tables.

Avaorgoune ( 2019-02-01 19:51:32 +0000 )edit

With what kind of capture tool, did you take the trace?

Christian_R ( 2019-02-12 16:37:47 +0000 )edit

Wireshark. Or are you asking what type of a device I used?

Avaorgoune ( 2019-02-12 19:36:12 +0000 )edit

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2019-02-12 15:09:24 +0000

Avaorgoune
1 ●1 ●1 ●1

We got the traffic to stop for now by replacing the switch that seemed to be causing the most issues. I do not have much confidence that this will solve our problem long term, but I'm hopeful. I will update if things change.

edit flag offensive delete link

add a comment

answered 2019-02-01 19:42:06 +0000

Guy Harris
19890 ●3 ●659 ●207

I'd suggest starting with what the answer to the old question says. An OUI of 00:00:00 is assigned to Xerox; that either means 1) there's Xerox hardware that uses it or 2) it's assigned to Xerox, the original inventors of Ethernet, to keep it permanently reserved. If you don't have any Xerox equipment on your network, those packets are probably coming from a device that's putting bad packets on the network.

edit flag offensive delete link

Comments

We got the traffic to stop for now by replacing the switch that seemed to be causing the most issues. I looked for any all-zero mac addresses already and couldn't find anything in any of the mac tables as the previous article suggested.

Avaorgoune ( 2019-02-01 19:52:06 +0000 )edit

@Avaorgoune can you provide as a trace withe this packet?

Christian_R ( 2019-02-03 10:32:47 +0000 )edit

Below is a short snippet of the millions of captured packets:

+---------+---------------+----------+
16:50:05,100,941   ETHER
|0   |00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|06|09|00|01|56|00|0e|00|22|00|2a|00|00|ff|ff|fe|ba|01|45|00|07|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00 ...

(more)

Avaorgoune ( 2019-02-04 12:52:58 +0000 )edit

add a comment