| 1 |
On Jan 23, 2012 12:57 AM, "Grant" <emailgrant@×××××.com> wrote: |
| 2 |
> |
| 3 |
|
| 4 |
----- >8 snip |
| 5 |
|
| 6 |
> |
| 7 |
> Also the MAC indicated in the firewall log is 14 blocks long and the |
| 8 |
> local system in question has a MAC address 6 blocks long according to |
| 9 |
> ifconfig, but the 6 blocks from ifconfig do match 6 of the blocks |
| 10 |
> reported by the firewall. |
| 11 |
> |
| 12 |
> Does this make sense to anyone? |
| 13 |
> |
| 14 |
|
| 15 |
It's (source MAC):(dest MAC):(payload type) |
| 16 |
|
| 17 |
(payload type) is usually 08:00 unless you're using SNAP/LLC |
| 18 |
|
| 19 |
Rgds, |
Archives