Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

unknown packet in sniffer 7609 trace

I have my NG sniffer capturing on a vlan in my 7609.

It is seeing a whole bunch of 64 byte L2 multicasts every 2 seconds.

The packets all have a source of NDC Dxxxxx and a destination of 01000CCCCCCD. The SNAP vendor id is Cisco1, Type 010B.

What sort of packets are they ??

6 REPLIES
Community Member

Re: unknown packet in sniffer 7609 trace

I assume that this is a trunk link (802.1Q or ISL) that the Sniffer is connected to. Those are Per VLAN Spanning Tree+ (PVST+) BDPUs which are sent every hello time which by default is 2 seconds. If you have x VLANs, you will see (x-1)/2 PVST+ BPDUs every second. So if you have 100 VLANs you will see 49.5 PVST+ BPDUs/second on a trunk link

Community Member

Re: unknown packet in sniffer 7609 trace

Thanks for that.

yes, it is an dot1q trunk.

I do see the pvst bpdu's every 2 seconds as well. Sniffer decodes these as bpdu's. Their destination is multicast address 0180C2000000.

I also see every 30 seconds DISL packets whose destination is 01000CCCCCCC.

The packets i'm concerned with are in addition to the bpdu's and DISL packets. Their destination is 01000CCCCCCD and there are so many of them that all appear to be the same.

I only have 2 vlan's configured but see about 16 of these mystery packets every 2 seconds, and they all look the same.

Community Member

Re: unknown packet in sniffer 7609 trace

BPDUs on VLAN 1 are addressed to 0180C2000000 (this is the well known MAC address for IEEE STP BPDUs) which ths Sniffer is able to decode.

BPDUs on all other VLANs (if using PVST+, which is the default STP mode) are addressed to 01000CCCCCCD (this is the MAC address used by Cisco for PVST+ BPDUs). These packets are 802.1Q tagged and the Sniffer is probably not able to decode. Note that the SNAP type for PVST+ BPDUs is 0x0104.

See http://www.cisco.com/warp/public/473/103.html for more details

Community Member

Re: unknown packet in sniffer 7609 trace

Thanks a lot.

Community Member

Re: unknown packet in sniffer 7609 trace

Thanks a lot.

Community Member

Re: unknown packet in sniffer 7609 trace

In my previous posting, I stated that the SNAP type for PVST+ BPDUs is 0x0104 (which was not correct). 0x0104 is the SNAP type for PAgP frames. The SNAP type for PVST+ BPDUs is 0x010b (consistent with what was stated in the original posting)

665
Views
0
Helpful
6
Replies
CreatePlease to create content