This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Function of the 00:ca:fe OUI (unregistered)

0

What is the function of the 00:ca:fe OUI?

The IEEE look-up tool doesn't show a owner: https://standards.ieee.org/develop/regauth/oui/public.html

In my environment, I believe that an Avaya PBX (which I suspect is implemented as VMs atop the Xen Hypervisor) is sending frames using this OUI. e.g. 00:ca:fe:01:97:65 and 00:ca:fe:46:13:32 [It also sends frames using a Xen-registered OUI and an Avaya-registered OUI.]

This smells like an error to me -- seems to me that no device wants to send frames using an unregistered OUI. On the other hand '00:ca:fe' seems like a human picked it -- the similarity to the French term 'cafe', its association with coffee, and the wide-spread (in languages other than French) use of the term.

?

--sk

asked 01 Jun '15, 06:07

skendric's gravatar image

skendric
11111113
accept rate: 0%


3 Answers:

0

Looks handpicked to me, too. Maybe someone set it by hand; it's not unheard of that admins sometimes do this for various reasons (fun, keeping it persistent in multiple locations, easy recognition in capture, etc). The only way to be sure is to find the admin of the device and ask.

BTW, TraceWrangler also sets unused OUIs when sanitizing frames, especially because they are officially unused and cannot be linked to anyone ;-)

answered 01 Jun '15, 07:11

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

0

If the MAC address is "human picked" then the administrator should have set the U/L bit as 1 for locally administered. Since the MAC address is 00, the U/L bit is not set and is available for an OUI.

answered 01 Jun '15, 08:16

Amato_C's gravatar image

Amato_C
1.1k142032
accept rate: 14%

Right, the keyword being "should" :-)

(01 Jun '15, 08:18) Jasper ♦♦

The management software should enforce this.

(01 Jun '15, 08:28) Jaap ♦

0

At least according to the Military Unique Deployment Guide For (various pieces of Avaya hardware), it's something Avaya uses with Xen:

On dom0: change file “/etc/xen/cm” to add virtual NIC (mybridge) to CM

a. The file will contain a line that looks something like this:

     vif = [mac=00:CA:FE:27:43:37,bridge=avpublic]

(see section B1.7 "Enable Out of Band Management Interface").

The Google search that found that document also found other Avaya documents that speak of 00:ca:fe in MAC addresses.

answered 01 Jun '15, 17:11

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

edited 01 Jun '15, 17:12

Thanx folks, this gets me the info I was wanting

--sk

(04 Jun '15, 04:45) skendric