Wireshark-users: Re: [Wireshark-users] Unknown OUI's...
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: <Tim.Poth@xxxxxxxxxxx>
Date: Mon, 9 Nov 2009 10:23:40 -0500

This looks like Crestron

http://www.crestron.com/products/show_products.asp?type=commercial

 

Heidelbe has a few more hits so good luck there

http://standards.ieee.org/cgi-bin/ouisearch

 

I am way out of date on my cisco but I think you can look at what mac addresses are attached to what ports, might take some time but should be able to track down the port, unplug it and wait for someone to complain about something not working.

 

Good luck

tim

 

From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Phillip Nelson
Sent: Monday, November 09, 2009 10:14 AM
To: wireshark-users@xxxxxxxxxxxxx
Subject: [Wireshark-users] Unknown OUI's...

 

I just experienced a Vlan saturation event where the following source and destination MAC address were in all the packets causing the saturation. Does anyone recognize the OUI's of these two addresses? I have tried to look them up and can't find them anywhere.

 

The network has a 6509 for its core and 30 switches connected by fiber. Of the 30 switches, 11 are 4003's. Of the 4003's, 5 were affected by the storm and only two were participating in the storm. The trace was taken from the Cisco 6509 and the two participating Cisco 4003's. The broadcast storm was exactly the same between the two switches. We have ruled out all devices connected to the switches. We cannot find the MAC addresses anywhere on the network. We stopped the storm by resetting all the ports on the two 4003's.

 

 

Heidelbe_ab:99:6f        Crestron_eb:ac:cf             0x883d              Ethernet II

 

Phil Nelson

Arrow ECS

Infrastructure Engineer, Senior

28600 Fountain Pkwy

Solon, Ohio 44139

 

email- pnelson@xxxxxxxxx

w-216-332-3405

c-330-524-0463

f- 440-498-5178