5

An ISP came and set up their radios the other day. After connecting my router to the radio and configuring it with the IP address, netmask, and gateway which they specified, I can't ping their gateway (it doesn't even answer ARP queries).

However, doing a packet trace on the radio's Ethernet port, I can see a constant stream of frames with EtherType 9C9D. They are directed to 2 specific MAC addresses, and it seems that something is sending them once per second.

Here is an excerpt from tcpdump:

11:57:58.401652 00:15:67:64:f5:55 (oui Unknown) > 00:00:07:d6:c4:f3 (oui Unknown), ethertype Unknown (0x9c9d), length 62: 0x0000: 8d00 1000 8b00 1065 8d00 1000 0000 002a .......e.......* 0x0010: 0260 d742 0000 0000 0000 0000 0000 0000 .`.B............ 0x0020: 0000 0007 0000 0015 6764 f555 0103 f2f2 ........gd.U.... 11:57:58.901660 00:15:67:64:f5:55 (oui Unknown) > 00:15:67:00:00:02 (oui Unknown), ethertype Unknown (0x9c9d), length 62: 0x0000: 8d00 1000 8b00 1065 8d00 1000 0000 002a .......e.......* 0x0010: 0260 d746 0000 0000 0000 0000 0000 0000 .`.F............ 0x0020: 0000 0007 0000 0015 6764 f555 0103 f2ee ........gd.U....

Google is failing me here. Does anyone know what those frames are???

Improve this question
3
  • Would you mind posting one of those frames? Sounds like some sort of keepalive/health check.
    – Ricky
    May 26, 2015 at 21:03
  • @RickyBeam, thanks for your comment. tcpdump output added. Please let me know if I should post a pcap file or something instead.
    – Alex D
    May 27, 2015 at 6:46
  • -XX please, so we see the entire packet
    – Ricky
    May 27, 2015 at 7:07

2 Answers 2

Reset to default
2

Those look like some sort of topology discovery mechanism (like cdp or lldp.)

(It's as if it's searching for an NMS or link-partner to know how to configure itself. But I'm not familiar with how Radwin's gear works. I would hope your ISP has any required documentation and experience with this stuff.)

Improve this answer
2
  • Do you think these frames are originating from the radio on our side, or from something on the other side (passing through the radio link)?
    – Alex D
    May 27, 2015 at 7:26
  • There are two Radwin MACs involved, but the second one (00:15:67:00:00:02) seems suspicious since it's #2. There's also a Xerox MAC involved, do you have anything on your side that might have a Xerox ethernet phy in it? For wireless provisioning purposes a stream of small and otherwise useless packets could be used to either generate signal stat data in spite of a lack of other traffic, or detect a layer 2 loop in the case that the radio is being used in a mesh topology.
    – Jeff Meden
    May 27, 2015 at 13:03
0

The Ethertype bytes will get altered to something unique if additional VLAN tagging is in use on the link. This might also explain your lack of connectivity. Perhaps the vendor requires a specific VLAN for normal traffic?

Improve this answer
1
  • 2
    If those frames were VLAN tagged, the "EtherType" should be 8100.
    – Alex D
    May 26, 2015 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.