Packet Sniffer Question

[Driftwood50]

Hi,

Just installed the WRT54G router and thought I would try this evaluation version of Commview. Could anyone tell how the destination MAC address of "01:80:C2:00:00:00" correlates to my network? I haven't any wireless devices and I was wondering if this is normal.

Thanks,
DW

[foolishone]

Every ethernet card every sold, or to be sold, either wireless or wired, has a unique ID, called a MAC, Media Access Control. Packets contain the MAC address of the destinatiom card because how does the packet know which wireless/wired card go to (say the IP address changes, like in a DHCP situation, during the process. Where does the packet go to...say the IP used no longer exists?) I really don't know why it shows the MAC address instead of the IP address.

For example, in the Admin controls of the router you can "manipulate" MAC addresses. You can block or only allow packets from certain MAC ID's.

I don't know if its normal, but there is nothing wrong.

^fo

[Driftwood50]

Hi foolishone, (don't really mean that)

Thanks for your reply. I know what a MAC ID is but mine is actually aliased so your not seeing my actual MAC ID, the one you do see is a destination MAC, but who's?! I ran a nic verifier and came up empty handed. I then researched it on the web and found this, "0180C2 STP." Being not really up on networks/networking I want to know what it is. All I could find was something about a twisted pair, which means nothing to me.

I guess what I should have said is I don't have any wireless devices and have a physical hardwire to the router. I disabled all sharing services, uninstalled the terminal services, telephony,etc...but I was just curious how the destination MAC fit into the scheme of things and why it continously populates the screen you see. Is it something I need to fix? My connection is solid (working).

Thanks again!

DW

[glc]

Not only do all wired and wireless network adapters have a MAC address, so do all cable modems, PPP adapters (dialup), and routers.

[DragonNOA1]

If it's stored in your local dns cache an "arp -a" command might reveal it.

[Driftwood50]

Hi GLC,

Thanks for jumping in here! I'm guessing by what you say that this could be the MAC to the PPP adapters, considering I've disabled services associated with dialup?! Found somewhere online that you as long as your using a router you can disable these features, correct? Also, would I want to disable/manual or automate my DNS services and/or how about Web client as I'm on a standalone (no network).

Thanks guys,
DW

Originally Posted by glc Not only do all wired and wireless network adapters have a MAC address, so do all cable modems, PPP adapters (dialup), and routers.