Path: utzoo!utgpu!water!watmath!clyde!att!osu-cis!tut.cis.ohio-state.edu!mailrus!ames!hc!pprg.unm.edu!cyrus
From: cyrus@pprg.unm.edu (Tait Cyrus)
Newsgroups: comp.dcom.lans
Subject: Re: DEC LAN Bridges
Message-ID: <23652@pprg.unm.edu>
Date: 20 Oct 88 14:52:56 GMT
References: <773@dogie.edu> <1041@gvgpsa.GVG.TEK.COM>
Reply-To: cyrus@pprg.unm.edu (Tait Cyrus)
Organization: U. of New Mexico, Albuquerque
Lines: 48

Dave White asks:
>I would also question what the real cause of the problem is, in other
>words, what device on your network is sending out messages with
>ff-ff-ff-ff-ff-ff as the source address?  Find the culprit(s) and
>fix them also.

We, like everyone else, are being bitten by this DEC LANBridge bug.
We have even been able to capture the bogus packet though.
Unfortunately, the packet contained ALL 1's (i.e. ff ff ff ff ff ....)
so there was no way to tell which "box" sent it.

I have, though, some idea as to which "boxes" are sending these
packets.  In 5 days, 3 of these packets have been seen on our net
coming from different places on the net (i.e. different "boxes").
Looking at ruptimes and such, I noticed that a machine had just been
rebooted (15 minutes after the bogus packet).  A possibility is that
this machine sent the bogus packet upon reboot/shutdown/crash.  I
chalked this up to coincidence.  A few days later I saw two more
bogus packets (100 seconds apart) from a DIFFERENT part of the net, a
net were a "box" was having new software installed.  Again I chalked
this up to coincidence.

Ok, so far nothing "really" out of the ordinary.  Well, it turns out
that both "boxes" are IBM PC/RT's, one running AIX and the other having
BSD 4.3 installed on it.  I am NOT saying that the IBM PC/RT (with UB
ethernet boards) is causing the problems, it is that I find it fairly
interesting that there is such a coincidence.

While watching the net, I have walked up to an IBM PC/RT and powered
it off allowing it to reboot; no bogus packets seen.  I have shut the
IBM down (gracefully); again no bugus packets.

Has anyone seeing these bogus packets noticed similar circumstances?
Could it the IBM PC/RT?  Could it the UB ethernet board?  Could I be
looking at events that are pure coincidence?  Am I full of it? :-) 

Comments/ideas/suggestions/flames/etc ?????

---
    @__________@    W. Tait Cyrus   (505) 277-0806
   /|         /|    University of New Mexico
  / |        / |    Dept of ECE - Parallel Processing Research Group
 @__|_______@  |    Albuquerque, New Mexico 87131
 |  |       |  |
 |  |  hc   |  |    e-mail:
 |  @.......|..@       cyrus@pprg.unm.edu
 | /        | /
 @/_________@/