nomin's profile - activity

Decrypted HTTP/2 list entry shows only first stream type I am decrypting HTTP/2 in Wireshark and I've found that some of

I am monitoring a home network and I see periodic Ethernet II frames sent from 00:00:00:00:00:00 to random MACs xx:xx:xx:xx:00:00. For example:

Frame 96694: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 1a:88:51:05:00:00 (1a:88:51:05:00:00)
    Destination: 1a:88:51:05:00:00 (1a:88:51:05:00:00)
    Source: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Type: Unknown (0x0000)
Data (46 bytes)
    Data: 000000000000000000000000000000000000000000000000…
    [Length: 46]

The last 4 of dst is always 00:00. The type is always Unknown (0x0000). The data is always 46 bytes of zeroes. I have no idea what could be sending this. It is a typical home network. Amazon Fire Stick, LG TV, Playstation, some Android phones, some Android tablets, some Windows laptops and a Windows desktop (what I'm using Wireshark on and it's connected to the Linksys router via ethernet cable).

Interesting. I guess I'll have to go through the process of elimination. Thanks.

Ethernet II frames with random MAC destinations? I am monitoring a home network and I see periodic Ethernet II frames se