[unisog] Strange things from our residence.

John Kristoff jtk at depaul.edu
Wed Oct 23 23:17:39 GMT 2002


On Tue, 22 Oct 2002 15:26:59 -0400
Pete Hickey <pete at shadows.uottawa.ca> wrote:

> SO we've had a weird problem (on a subnet) in one of our residences.
> It seems like people were gradually loosing connectivity.  What was
> happening is that someone was sending out ethernet packets with a
> source MAC address of FFFFFFFFFFFF..  A broadcast as the asource.
> 
> NOw, what the switch was doing (a bug IMO) was noting that this was
> the MAC associated with that port.  Then, all broadcasts were directed

We tried recreating this on a lab switch today.  A station generating an
all 1's broadcast as the source MAC did not populate the address table
of our switch.  The test switch was a Cisco 3524-PWR-XL running
12.0(5)WC5 code.  We also had port security enabled on the port the
source was on, but allowed more MACs than were currently on the
associated port.

Care to comment on the vendor switch, the version of code and any
interesting configuration that may affect its behavior?  Your experience
certainly doesn't sound like proper bridge address table behavior
(perhaps technical legal, but certainly not sane).

John



More information about the unisog mailing list