ethernet address FF:FF:FF:FF:FF:FF

Hello,

I am trying to sniff ethernet packet using libpcap.a library.

I am getting one of the address as FF:FF:FF:FF:FF:FF .

Can anybody tell what does this mean ?

Regards,
Tejas Kokje
University of Southern California
Los Angeles

Tejas Kokje <(E-Mail Removed)> writes:

> Hello,
>
> I am trying to sniff ethernet packet using libpcap.a library.
>
> I am getting one of the address as FF:FF:FF:FF:FF:FF .
>
> Can anybody tell what does this mean ?

I bet it's ethernet broadcast address.

--
__Pascal Bourguignon__ http://www.informatimago.com/

Nobody can fix the economy. Nobody can be trusted with their finger
on the button. Nobody's perfect. VOTE FOR NOBODY.

Tejas Kokje wrote on 06.08.2004 02:56:

> Hello,
>
> I am trying to sniff ethernet packet using libpcap.a library.
>
> I am getting one of the address as FF:FF:FF:FF:FF:FF .
>
> Can anybody tell what does this mean ?

This is a broadcast. It goes to any address on your network.

--
Walter

Am Thu, 05 Aug 2004 17:56:19 -0700 hat Tejas Kokje <(E-Mail Removed)>
geschrieben:

> Hello,
>
> I am trying to sniff ethernet packet using libpcap.a library.
>
> I am getting one of the address as FF:FF:FF:FF:FF:FF .
>
> Can anybody tell what does this mean ?

Yes, here is such another sniff: This shows an so called ARP-request,
which is done by the NIC, when it doesn't know the MAC-Address of the
destination NIC. This broadcasted through the whole network segment.

Frame 66 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: 00:50:ba:6d:29:f7, Dst: ff:ff:ff:ff:ff:ff
Destination: ff:ff:ff:ff:ff:ff (Broadcast)
Source: 00:50:ba:6d:29:f7 (10.17.1.30)
Type: ARP (0x0806)
Address Resolution Protocol (request)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (0x0001)
Sender MAC address: 00:50:ba:6d:29:f7 (10.17.1.30)
Sender IP address: 10.17.1.30 (10.17.1.30)
Target MAC address: 00:00:00:00:00:00 (00:00:00_00:00:00)
Target IP address: 10.17.1.5 (10.17.1.5)

> Regards,
> Tejas Kokje
> University of Southern California
> Los Angeles

Domski,
University of Applied Science
Schmalkalden

--
Of course it doesn't work. We've performed a software upgrade.
######################
Linux-User-ID: #291181
######################

"Tejas Kokje" <(E-Mail Removed)> wrote in message
news(E-Mail Removed)...
> Hello,
>
> I am trying to sniff ethernet packet using libpcap.a library.
>
> I am getting one of the address as FF:FF:FF:FF:FF:FF .
>
> Can anybody tell what does this mean ?
>
> Regards,
> Tejas Kokje
> University of Southern California
> Los Angeles

It is the layer 2 broadcast address.

--
Angel R. Rivera aka Wolf
----------------------------------------------------------------
Please post all reponses to UseNet. All email cheerfully and automagically
routed to Dave Null