Wireshark-bugs: [Wireshark-bugs] [Bug 2152] IEEE locally assigned addresses reported as belongin
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2152
------- Comment #1 from jaap.keuter@xxxxxxxxx 2008-01-02 12:18 GMT -------
(In reply to comment #0)
> I've randomly chosen some locally assigned IEEE / MAC addresses for a virtual
> network I've setup, and have found that the values I've chosen happen
> correspond to some locally assigned addresses Microsoft have decided to use
> (and then globalise) for their MS Network Load Balancer software. I'm not using
> any MS software at all in this virtual network.
Very well. Since you administer the addresses yourself you should be aware of
all addresses in your domain. The IEEE assigned addresses are unique, so that
covers the uniqueness requirement. For the locally assigned addresses the
burden is to you. You are not using the MS NLB solution, so you've covered that
as well.
> e.g. in tshark,
>
> --
> Ethernet II, Src: MS-NLB-PhysServer-02_00:00:00:01 (02:02:00:00:00:01),
> --
>
> I don't think wireshark/tshark should be showing these locally assigned MAC
> addresses as being used for a Microsoft product or belonging to Microsoft,
> because it's misleading to people who don't know the purpose of the locally
> assigned bit/address space.
You shouldn't confuse Wireshark as being authoritative in these matters. It
tries to show the most common interpretation for the data it sees, but there's
always some guesswork involved. Same here. The MAC addresses you mention are
being mentioned in documentation regarding MS NLB. That is where this guesswork
is based upon.
> (I'd hope Microsoft provide a way to change these values - you'd hate to find
> that you've, quite rightly, configured these addresses in your network for
> something else, and then go to try to introduce MS NLB, and have mac address
> collisions.
That is exactly what locally administered means: the local administrator has to
assure uniqueness. He can quite rightly configure these addresses in the
network, but is also responsible for the collision when introducing MS NLB.
I guess there's either some item in the configuration console or some fancy
registry key to do that. I don't know the details.
> MS should have gone and got their own OUI, and then used addresses
> out of that - guaranteeing world wide uniqueness.)
The problem with that is worldwide uniqueness. Creating a MAC address from the
OUI has to be worldwide unique, but these aren't put into hardware. It's used
as an application address, controlled by software. The software can't guarantee
there be no collision, while the burden of locally uniqueness falls to the
administrator when using the addresses they do.
--
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
