Re: Bogon IPs traffic only seen by netflow, confined within a VLAN only


On Apr 9, 2006, at 9:29 PM, Valdis.Kletnieks@xxxxxx wrote:

The usual cause for this is a busticated NIC - in years gone by, similar
things were caused by "jabbering" transceivers that would start transmitting
their packet sooner than the spec allowed, resulting in the first few bytes
being dropped, or noise bytes being added...

There's an outside chance that there's a packet-crafting program with an
off-by-one error, but I've seen this caused more often by broken hardware.


Good point - this is where an analysis of the traffic would be helpful, to see if there appear to be 'conversations' taking place or if it's just random garbage (I suspect the latter as you indicate, but that's purely speculative without data).

----------------------------------------------------------------------
Roland Dobbins <rdobbins@xxxxxxxxx> // 408.527.6376 voice

Everything has been said. But nobody listens.

-- Roger Shattuck

Relevant Pages

  • Re: USB GetDescriptor(Configuration) Error?
    ... And I'm not sure how I developed my false assumption about needing to send a zero length packet if the transfer length falls on the packet length boundary, since quite obviously you are correct about the USB 2 spec, and the USB 1.1 spec contains the same description of the process. ... I am still curious, however, when I watch bus traffic with an analyzer, the initial enumeration does involve a zero length data packet before the host begins the status stage, whereas the request my driver places does not. ...
    (microsoft.public.development.device.drivers)
  • Re: [tcpdump-workers] [PATCH] Add ioctl to disable bpf timestamping
    ... to infer a more accurate RTT with an associated response packet. ... the time stamps you'll get ... has to wait for others to finish transmitting, or deal with collisions, ...
    (freebsd-net)
  • Re: Looking for Wi-Fi
    ... is transmitting at a given instant, then my packet will get through. ... the remote receiver point you may get packets trampled on but there is a ... Most traffic profiles leave masses of free air time for other networks to ...
    (uk.comp.os.linux)
  • Re: Can a standard NIC be triggered to send an electrical signal?
    ... Say I write a program that creates a packet and inject it on the line. ... > With a normal 10Base-T Ethernet card normally when nothing ... > card sends a set of electrical signal pulses to the line... ... > When Ethernet card is transmitting data, you get bits on the line. ...
    (comp.dcom.lans.ethernet)
  • Re: Ambiguities in TCP/IP - firewall bypassing
    ... > Identify what the packet should be, ... > the correct way to handle these packets, then these stacks are correct. ... As I said, the spec is ambiguous. ... The spec is silent on the use of ambiguous or contradictory flags ...
    (Bugtraq)