strange MACs in tcpdump output

Alexander Vasenin aka BlackSir blacksir at number.ru
Fri Jul 16 10:11:59 PDT 2004


What is the strange MACs in braces in the following output, and why on some lines it exist while on others - is not. I've checked tcpdump(8) and arp(4) and found nothing about this...

[root@*] tcpdump -envvvi fxp2 arp and not ether host 0:60:b0:3c:92:86
tcpdump: listening on fxp2
19:53:38.727058 0:5:5d:25:ce:3e ff:ff:ff:ff:ff:ff 0806 60: arp who-has 192.168.254.1 (fe:1:0:0:cc:88) tell 192.168.254.253
                  ^^^source         ^^^target                                             ^^^???
Real MAC of 192.168.254.1 is 0:60:b0:3c:92:86

19:54:01.544218 0:20:ed:85:6a:5c ff:ff:ff:ff:ff:ff 0806 60: arp who-has 192.168.198.1 tell 192.168.198.25

19:54:02.181343 0:d0:b7:a9:a4:3a ff:ff:ff:ff:ff:ff 0806 60: arp who-has 192.168.198.1 tell 192.168.198.11

19:54:18.503453 0:c0:49:cc:c1:2 ff:ff:ff:ff:ff:ff 0806 60: arp who-has 192.168.208.65 (0:60:b0:3c:92:86) tell 192.168.208.75
Real MAC of 192.168.208.65 is 0:60:b0:3c:92:86

20:10:25.121986 0:5:5d:ed:6d:68 ff:ff:ff:ff:ff:ff 0806 60: arp who-has 192.168.254.1 (5d:ed:6d:68:c0:a8) tell 192.168.254.252
                                                                                       ^^^???
What is it? MAC in braces is like src MAC 'shifted' by 16bits???

Alexander Vasenin aka BlackSir


More information about the freebsd-net mailing list