> address is a multicast address and is currently set to be:
> 0x01_00_0C_00_00. The first 40 bits of the DA field signal the
> receiver that the packet is in ISL format.
>
>so the Ethernet dissector can check the destination address and
>special-case it.
FWIW, take note that the Cisco multicast OUI of 01-00-0C is used for some
other things too. I have seen Cisco routers sending periodic announcements
to 01-00-0C-CC-CC-CC that have something to do with IOS. So make sure you
use the WHOLE destination address and not just the top 6 bytes.
Also, in case you hadn't noticed, the fact that the first octet is 01 means
the packet is a multicast. Which makes sense if you have a large switched
network, all switches can pick up all ISL traffic off the backbone and make
individual decisions based on content whether that packet should be
forwarded to its ports, and to which of its ports. That way each switch
doesn't have to know the rest of the network to transmit ISL.
=====================================
Tim Farley
Software Engineer
tfarley@xxxxxxx
Internet Security Systems, Inc.
(678) 443-6000 / Direct Dial (678) 443-6189 / fax (678) 443-6479
http://www.iss.net
ISS CONNECT 2000
International User Group and Information Security Summit
March 19-24, 2000 http://connect.iss.net
REGISTER TODAY!
=====================================
