DLC Source Address Multicast

[Kyusaku]

This one has been driving me crazy. Hopefully someone else has experienced this before. While capturing all traffic(i.e...default filter)I noticed a symptom on the DLC layer within the expert. "DLC Source Address Multicast" the mac address reported is 434343434343. I built a monitor filter based on this and I am watching it from the Matrix Map. This strange mac address is the source for multiple destinations. I found out that the cause is related to a faulty network card. But the problem now is finding the perpertraitor. I have examined surrounding frames but cannot find any clues as to the true source of the issue. Anyone have an idea?

Let me know if anymore detail is needed.

Thanks!

 

[jdeisenm]

Is Sniffer connected to a hub, switch, span port?
If to a hub, what other devices are connected to the hub?
Are any of them not working or slow?
Are there any other errors (collisions).
Unplug devices one at a time to see the symptom disappears.

If sniffer is connected to a switch port, what does the switch port say? Does it report any errors, colisions, etc?

I bet a device has a bad nic driver.

Potentially there could bad hardware or a bad cable as well.

 

[rwullems]

correct me if i am wrong, I do not have my books at hand here, but the 343434343 is also a back pressure signal of I believe 3com devices.

So depending on where in the (corrupted?) frame you find these patterns, it can be a backpressure signal, or you have indead a corrupt hub or nic port..?

Robert Wullems
Network Specialist
SCP/SCE/SCM/CNX/MCP/MCSA/Network+/CNA
***************************************
If you can Sniff it, you can solve it!
***************************************

 

[Kyusaku]

jdeisenm

We use netoptics taps for our sniffing. I would love to unplug devices...but I think our 200+ users wouldn't have as much fun as I would...

rwullems

All our switches are 3com...I have also seen the 3434343434 address as you described. Our switches also employ flow control which I believe relates to backpressure. I am going to try disabling it and see if that solves the issue.

Thanks