Unknown sniffed data from IDS sensor 4215

chloi · ‎07-30-2003

Hi all, when i snoop from my IDS, all the data i snoop was like the following... why is it like that?

anyone can help?

thanks!

? -> * ETHER Type=8100 (Unknown), size = 149 bytes

? -> * ETHER Type=8100 (Unknown), size = 212 bytes

? -> * ETHER Type=8100 (Unknown), size = 149 bytes

? -> * ETHER Type=8100 (Unknown), size = 212 bytes

? -> * ETHER Type=8100 (Unknown), size = 149 bytes

? -> * ETHER Type=8100 (Unknown), size = 212 bytes

? -> * ETHER Type=8100 (Unknown), size = 64 bytes

? -> * ETHER Type=8100 (Unknown), size = 594 bytes

jsivulka · ‎08-05-2003

This basically indicates that frames being looked at are of a feature which is not supported. If you are running IOS 12.1, the reason would be that all the frames to the SPAN destination port come with 802.1Q tag which SNOOP does not support. You could use a sniffer to check the same.

scothrel · ‎08-05-2003

8100 is the 802.1Q vlan tag type. Snoop does not understand vlan tagging. Try something like tcpdump and ethereal or some other "real" sniffer.

SC

PS. the IDS understands 802.1Q tagging...

csmeriglio · ‎08-05-2003

On the same topic, what does the following sniffed data represent???

? -> (multicast) ETHER Type=0000 (LLC/802.3), size = 52 bytes

and

? -> (multicast) ETHER Type=2000 (Unknown), size = 388 bytes