While capturing packets on my Raspberry Pi via my Wireshark tap (sudo tcpdump -i eth0 -w - > tcpdump.data) between my MacBook Pro and eero base station on ethernet, not wifi, the following packet showed up. It's an ethertype 0x9104. There's no such thing according to the official protocol list. The MAC 60:5f:8d:1f:36:52 is for the eero.
Does anyone know of this undocumented ethertype? The decode below of the 0x9104 is just a guess on my part.
Assuming this was put "on the wire" by the MacBook, I'm searching for where to post this to Apple knowledgeable people. Please shove me in the right direction, if you know. 68 years old and I still don't know enough.
** tcpdump HeaderPacket ** 2020-04-21 09:47:14.827732 Packet octets 64, (0x40) Packet length 64, (0x40) Packet . ffff ffff ffff 605f 8d1f 3652 9104 0260 5f8d 1f36 5200 0000 0000 0000 0000 0000 . ` _ 6 R ` _ 6 R . 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 . . ** Ethernet ** . MAC source 255:255:255:255:255:255 (ff:ff:ff:ff:ff:ff) . MAC destination 96:95:141:31:54:82 (60:5f:8d:1f:36:52) . Length/Type 37,124, (0x9104) . Packet . . ffff ffff ffff 605f 8d1f 3652 9104 0260 5f8d 1f36 5200 0000 0000 0000 0000 0000 . . ` _ 6 R ` _ 6 R . . 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 . . . . ** IEEE8029104 ** . . Code 2, (0x2) . . MAC 96:95:141:31:54:82 (60:5f:8d:1f:36:52) . . Packet . . . 0260 5f8d 1f36 5200 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 . . . ` _ 6 R . . . 0000 0000 0000 0000 0000 0000 0000 0000 0000 . . .
A "tcpdump -r tcpdump.data" of the capture file produced this:
09:47:14.827732 60:5f:8d:1f:36:52 (oui Unknown) > Broadcast, ethertype Unknown (0x9104), length 64:
0x0000: 0260 5f8d 1f36 5200 0000 0000 0000 0000 .`_..6R.........
0x0010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0020: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0030: 0000 ..
