Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Posting-Version: version B 2.10.1 6/24/83; site cheviot.UUCP
Path: utzoo!linus!philabs!cmcl2!seismo!mcvax!ukc!cheviot!robert
From: robert@cheviot.UUCP (Robert Stroud)
Newsgroups: net.lan
Subject: Peculiar Ethernet packets (type 0x6002)
Message-ID: <320@cheviot.UUCP>
Date: Thu, 25-Apr-85 22:19:52 EST
Article-I.D.: cheviot.320
Posted: Thu Apr 25 22:19:52 1985
Date-Received: Sat, 20-Apr-85 09:07:43 EST
Reply-To: robert@cheviot.UUCP (Robert Stroud)
Organization: U. of Newcastle upon Tyne, U.K.
Lines: 37

We have an Ethernet with two VAXes running 4.2 BSD at one end, and
various Perqs at the other end. The Perqs use ISO protocols rather
than DOD Arpanet protocols, so normally don't talk to the VAXes.
However, I added some tracing to one of them to use it as an Ethernet
monitor and watch what went by. Naturally, it should have only picked up
broadcast packets or packets specifically addressed to itself.

I could see three types of packets going past. One came from the
rwho daemon (IP Type 0x800, UDP Type 0x11, Port 0x201) and one
had type field 0x806 and was clearly the Address Resolution Protocol.
However, the third type of packet had a type field of 0x6002 and
is a complete mystery. Can anyone tell me what it is? It is much less
frequent than the rwho packets (every 10-20 minutes?), and the Destination
address doesn't make any sense to me. I certainly don't see why it
is being received by the Perq in question, although it is definitely
being sent by one of the VAXes.

If it is any help, here are the first few bytes of the protocol in hex...

TO: AB00 0002 0000 FROM: AA00 0301 02E0 TYPE: 6002

1c 00 07 00 00 00 01 00 03 03 00 00 02 00 02 05 00 07 00 06 aa 00 03 01
02 e0 64 00 01 01 00 (sixteen times) f3 cc 80 da 80 da 80 da ...

By the way, the packet is always the same.

Is the TO address some sort of multicast address? (Why is the third part 
of it zero?). The FROM address corresponds to one of the VAXes.

Please mail me, and I'll summarise to the net if there's any interest.

Robert J Stroud,
Computing Laboratory,
University of Newcastle upon Tyne.

ARPA robert%cheviot%newcastle.mailnet@mit-multics.arpa
UUCP ...!ukc!cheviot!robert