What is the function of the 00:ca:fe OUI? The IEEE look-up tool doesn't show a owner: https://standards.ieee.org/develop/regauth/oui/public.html In my environment, I believe that an Avaya PBX (which I suspect is implemented as VMs atop the Xen Hypervisor) is sending frames using this OUI. e.g. 00:ca:fe:01:97:65 and 00:ca:fe:46:13:32 [It also sends frames using a Xen-registered OUI and an Avaya-registered OUI.] This smells like an error to me -- seems to me that no device wants to send frames using an unregistered OUI. On the other hand '00:ca:fe' seems like a human picked it -- the similarity to the French term 'cafe', its association with coffee, and the wide-spread (in languages other than French) use of the term. ? --sk asked 01 Jun '15, 06:07 skendric |
3 Answers:
Looks handpicked to me, too. Maybe someone set it by hand; it's not unheard of that admins sometimes do this for various reasons (fun, keeping it persistent in multiple locations, easy recognition in capture, etc). The only way to be sure is to find the admin of the device and ask. BTW, TraceWrangler also sets unused OUIs when sanitizing frames, especially because they are officially unused and cannot be linked to anyone ;-) answered 01 Jun '15, 07:11 Jasper ♦♦ |
If the MAC address is "human picked" then the administrator should have set the U/L bit as 1 for locally administered. Since the MAC address is 00, the U/L bit is not set and is available for an OUI. answered 01 Jun '15, 08:16 Amato_C |
At least according to the Military Unique Deployment Guide For (various pieces of Avaya hardware), it's something Avaya uses with Xen:
(see section B1.7 "Enable Out of Band Management Interface"). The Google search that found that document also found other Avaya documents that speak of 00:ca:fe in MAC addresses. answered 01 Jun '15, 17:11 Guy Harris ♦♦ edited 01 Jun '15, 17:12 Thanx folks, this gets me the info I was wanting --sk (04 Jun '15, 04:45) skendric |
Right, the keyword being "should" :-)
The management software should enforce this.