Wireshark · Wireshark-dev: Re: [Wireshark-dev] Strip Ethernet broadcast / locally administered flags from address before doing

[Sake Blok <sake@xxxxxxxxxx>]

On Wed, Aug 15, 2007 at 04:26:23PM +0200, Joerg Mayer wrote:
> On Wed, Aug 15, 2007 at 03:31:08PM +0200, Sake Blok wrote:
> > I can't imagine myself situations where you locally assign an 
> > address and still be interested in the manufacturor of the card
> > from which the mac was used as seed. I usually use a BCD encoded
> > vlan-tag-number as the LA-mac, this would result in something
> > like "Local_00:01:30" for vlan 130 :-)
> 
> I don't think that's a good idea. Just leave the number in there,
> because otherwise addresses local_00:01:02 and local_00:01:02 would look
> the same, while the first local might have a value of 36:37:38 and
> the second local value might be 02:00:00

True, but that risk is already there for a lot of Vendors:

sake@richie:~/wireshark$ grep "^..:" manuf | awk '{print $2}' | sort | uniq -c | sort -rn | head
 321 Cisco
  52 Private
  28 NokiaDanma
  23 NortelNetw
  22 TexasInstr
  22 Intel
  21 Nortel
  19 3com
  18 SamsungEle
  18 HewlettPac
sake@richie:~/wireshark$ 

Of course the risk is bigger in this case, although I think in practice
it would not occur very often :-)

Maybe just adding a line:

02:00:00	Local			# LOCALLY ADMINISTRATED ADDRESS

would be an option. That way, there are no duplicates. This is of course
only beneficial other people besides me choose their locally administrated
addresses within 02:00:00:XX:XX:XX .

Are there any other people that choose their addresses like this?

Cheers,


Sake