Wireshark-dev: Re: [Wireshark-dev] Strip Ethernet broadcast / locally administered flags from a
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "ronnie sahlberg" <ronniesahlberg@xxxxxxxxx>
Date: Sat, 18 Aug 2007 07:51:25 +1000
On 8/17/07, Sake Blok <sake@xxxxxxxxxx> wrote:
> On Wed, Aug 15, 2007 at 04:26:23PM +0200, Joerg Mayer wrote:
> > On Wed, Aug 15, 2007 at 03:31:08PM +0200, Sake Blok wrote:
> > > I can't imagine myself situations where you locally assign an
> > > address and still be interested in the manufacturor of the card
> > > from which the mac was used as seed. I usually use a BCD encoded
> > > vlan-tag-number as the LA-mac, this would result in something
> > > like "Local_00:01:30" for vlan 130 :-)
> >
> > I don't think that's a good idea. Just leave the number in there,
> > because otherwise addresses local_00:01:02 and local_00:01:02 would look
> > the same, while the first local might have a value of 36:37:38 and
> > the second local value might be 02:00:00
>
> True, but that risk is already there for a lot of Vendors:
>
> sake@richie:~/wireshark$ grep "^..:" manuf | awk '{print $2}' | sort | uniq -c | sort -rn | head
>  321 Cisco
>   52 Private
>   28 NokiaDanma
>   23 NortelNetw
>   22 TexasInstr
>   22 Intel
>   21 Nortel
>   19 3com
>   18 SamsungEle
>   18 HewlettPac
> sake@richie:~/wireshark$
>
> Of course the risk is bigger in this case, although I think in practice
> it would not occur very often :-)
>
> Maybe just adding a line:
>
> 02:00:00        Local                   # LOCALLY ADMINISTRATED ADDRESS
>
> would be an option. That way, there are no duplicates. This is of course
> only beneficial other people besides me choose their locally administrated
> addresses within 02:00:00:XX:XX:XX .
>
> Are there any other people that choose their addresses like this?
>
> Cheers,

Microsoft Cluster creates a local mac address for the cluster by taking the
mac address of the primary node and just flipping the la bit.

If the primary node of the cluster has
04:05:06 -> Xerox

then the "virtual" mac address for the cluster itself will be
06:05:06

in that situation it is useful to do the matching by masking out the la bit