Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

full zero mac address

What would be the meaning of 00-00-00-00-00-00 mac address which is shown on a LAN sniffer report? It has been identified as a noise but I am unable to find which station produces this type of information.

Any recommendation would be greatly appreciated.

3 REPLIES
Bronze

Re: full zero mac address

If you are having problems tracking down the faulty NIC, you could try using an ACL to filter by ip address to determine which host is generating the noise.

For example, you could filter using something like this:

access-list 1 permit 10.1.1.0 0.0.0.127

access-list 1 deny 10.1.1.128 0.0.0.127

You could then determine if the faulty NIC is in the first or second half of that subnet. You could then further subnet the ACL to narrow down your search.

If you have more than one LAN interface, you can try shutting down an interface at a time to determine which interface the faulty NIC is on.

New Member

Re: full zero mac address

Hi ttuncaral,

Can you pl. brief me on what does the the 127 at the end of access list stand for.Pl let me understand the meaning of 2 lines.

Rgds

Kalyan

Bronze

Re: full zero mac address

127 is the inverse mask. (255.255.255.128 would be the normal mask, so if you subtract the normal mask from 255.255.255.255, you would get 0.0.0.127)

Here is a link that explains how to calculate an inverse mask:

http://www.cisco.com/warp/public/707/confaccesslists.html

By using this inverse mask, you can divide your subnet in half to determine if the faulty NIC is in the first half of the subnet or the second. For example, if your faulty NIC had an ip address of 10.1.1.130, you could apply an acl like this:

access-list 1 permit 10.1.1.0 0.0.127

access-list 1 deny 10.1.1.128 0.0.0.127

With this acl applied, you should stop seeing the all 0s MAC address in your sniffer trace since the 10.1.1.130 address is denied. The acl I suggested just helps you narrow down what ip address is causing you problems.

267
Views
0
Helpful
3
Replies
CreatePlease to create content