Zero MAC address

[Adarsh Joshi]

Thank you for the quick replies.

I am aware of the importance of the second bit. By invalid, I was wondering if that particular address is reserved or if it has any special meaning or purpose.

So in theory, I cannot classify it as an invalid MAC address on my packet statistics utility.

On a side thought, can an incoming packet be classified as "invalid MAC address" if it has the same MAC address of the host?

Thanks again
Adarsh


-----Original Message-----
From: Chuck Swiger [mailto:cswiger at mac.com]
Sent: Wednesday, March 14, 2012 3:57 PM
To: Adarsh Joshi
Cc: freebsd-net at freebsd.org
Subject: Re: Zero MAC address

On Mar 14, 2012, at 3:32 PM, Adarsh Joshi wrote:
> I assigned a 00:00:00:00:00:00 MAC address to one of my interfaces on a machine and tried to ping the peer machine. The ping did go through fine.
>
> I can the see the request and reply packets on the packet capture. I am wondering if that is legitimate and if not, who is supposed to check that. I mean, the stack or the driver on the sending machine or the receiving machine.
>
> Basically, I am trying to test a statistics utility which keeps track of packets with invalid MAC addresses.  Are the packets with zero MAC addresses be classified as invalid?

In theory, no-- 00:00:00 OUI belongs to Xerox, and there is nothing special about an all-zeros MAC.

If you see an OUI with the second bit of the first octet set, that would indicate locally managed addresses rather than global or "universally administered" numbering, otherwise you can lookup against OUI data from the IEEE:

  http://standards.ieee.org/develop/regauth/oui/oui.txt

...and that will let you identify the vendor of the ethernet NIC, SAS/fibre channel controller, etc...or conclude that someone is likely spoofing MAC addresses if you don't find the OUI listed.

Maybe that's what you mean by "invalid"?

Regards,
--
-Chuck



This message and any attached documents contain information from QLogic Corporation or its wholly-owned subsidiaries that may be confidential. If you are not the intended recipient, you may not read, copy, distribute, or use this information. If you have received this transmission in error, please notify the sender immediately by reply e-mail and then delete this message.