Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

full zero mac address

What would be the meaning of 00-00-00-00-00-00 mac address which is shown on a LAN sniffer report? It has been identified as a noise but I am unable to find which station produces this type of information.

Any recommendation would be greatly appreciated.


Re: full zero mac address

If you are having problems tracking down the faulty NIC, you could try using an ACL to filter by ip address to determine which host is generating the noise.

For example, you could filter using something like this:

access-list 1 permit

access-list 1 deny

You could then determine if the faulty NIC is in the first or second half of that subnet. You could then further subnet the ACL to narrow down your search.

If you have more than one LAN interface, you can try shutting down an interface at a time to determine which interface the faulty NIC is on.

New Member

Re: full zero mac address

Hi ttuncaral,

Can you pl. brief me on what does the the 127 at the end of access list stand for.Pl let me understand the meaning of 2 lines.




Re: full zero mac address

127 is the inverse mask. ( would be the normal mask, so if you subtract the normal mask from, you would get

Here is a link that explains how to calculate an inverse mask:

By using this inverse mask, you can divide your subnet in half to determine if the faulty NIC is in the first half of the subnet or the second. For example, if your faulty NIC had an ip address of, you could apply an acl like this:

access-list 1 permit 0.0.127

access-list 1 deny

With this acl applied, you should stop seeing the all 0s MAC address in your sniffer trace since the address is denied. The acl I suggested just helps you narrow down what ip address is causing you problems.

CreatePlease to create content