Ethereal-dev: Re: [Ethereal-dev] MAC Vendor Bug?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Fri, 9 Dec 2005 19:36:52 -0800 (PST)
Bryce Bockman wrote:
> I work for a networking and computer systems designer (XKL LLC) and I
> was in the lab sniffing some of our traffic.  I noticed that the version
> of Ethereal I'm running identifies MAC addresses starting with
> 0x00A0E3 as belonging to YangMeiT, but we're pretty sure that anything
> in this range should belong to XKL.

Maybe it's a problem with Ethereal on 36-bit platforms. :-)

>  Is this a bug in Ethereal, or is
> the data that the Ethereal builds with bad?

I'm not sure.  The 0.10.11 version of the "manuf" file that ships with
Ethereal (that file is where Ethereal gets manufacturer names) has
00:A0:E3 assigned to XKL and 00:0A:E3 assigned to Yang Mei Technology, so
either

    1) the addresses in question really start with 0x000AE3;

    2) there's a bug in Ethereal that causes us to nibble-swap the
*second* octet, but not the *third* octet (00:0A:E3 belongs to EADS
Telecom);

    3) something else strange is happening.

>  How can I find out?

Check whether the addresses assigned to Yang Mei start with 00:A0:E3 or
00:0A:E3.  (If the latter, and it really *is* XKL equipment, you should
probably contact somebody in your manufacturing department....)

If they start with 00:A0:E3, take the entries in the "manuf" file (which
is probably either in /usr/share/ethereal or /usr/local/share/ethereal)
for XKL and Yang Mei Technology (look for YangMeiT), and turn 0A to A0 and
*vice versa*, and see if that fixes the problem.