While Sniffing at a customer site I found some Ethernet II packets with an Ethertype of 8781. Several of my protocol analyzers decoded up to the Type portion of the packet and then indicated that the rest of the payload was not interpreted or decoded.
After some poking around I found that Ethertype 8780 - 8785 belongs to Symbol, as evident from the source MAC address (also Symbol).
These packets were being transmitted from a Symbol access point.
That's when chaos broke out since the customer was adamant that there wasn't any wireless in their environment. My wireless tools couldn't pick up a signal from an Access Point so this was surprising to me as well.
We used some software to identify with switch/slot/port this MAC address originated from and busted the wireless cowboy.
Just another reason not to ignore an undecoded packet. 'Making things work better; bit by bit.'
After some poking around I found that Ethertype 8780 - 8785 belongs to Symbol, as evident from the source MAC address (also Symbol).
These packets were being transmitted from a Symbol access point.
That's when chaos broke out since the customer was adamant that there wasn't any wireless in their environment. My wireless tools couldn't pick up a signal from an Access Point so this was surprising to me as well.
We used some software to identify with switch/slot/port this MAC address originated from and busted the wireless cowboy.
Just another reason not to ignore an undecoded packet. 'Making things work better; bit by bit.'
