Re: [gentoo-user] Strange outbound requests

[Pandu Poluan]

On Jan 23, 2012 12:10 PM, "Pandu Poluan" <pandu@××××××.info> wrote:
>
>
> On Jan 23, 2012 12:57 AM, "Grant" <emailgrant@×××××.com> wrote:
> >
>
> ----- >8 snip
>
> >
> > Also the MAC indicated in the firewall log is 14 blocks long and the
> > local system in question has a MAC address 6 blocks long according to
> > ifconfig, but the 6 blocks from ifconfig do match 6 of the blocks
> > reported by the firewall.
> >
> > Does this make sense to anyone?
> >
>
> It's (source  MAC):(dest MAC):(payload type)
>
> (payload type) is usually 08:00 unless you're using SNAP/LLC
>
> Rgds,

Oops, sorry, it's the other way around (dest):(source):(type).

It's the representation of the first 14 octets of the Ethernet frame.

Rgds,
 On Jan 23, 2012 12:10 PM, "Pandu Poluan" <pandu@××××××.info> wrote:

>
> On Jan 23, 2012 12:57 AM, "Grant" <emailgrant@×××××.com> wrote:
> >
>
> ----- >8 snip
>
> >
> > Also the MAC indicated in the firewall log is 14 blocks long and the
> > local system in question has a MAC address 6 blocks long according to
> > ifconfig, but the 6 blocks from ifconfig do match 6 of the blocks
> > reported by the firewall.
> >
> > Does this make sense to anyone?
> >
>
> It's (source  MAC):(dest MAC):(payload type)
>
> (payload type) is usually 08:00 unless you're using SNAP/LLC
>
> Rgds,
>