0

While capturing packets on my Raspberry Pi via my Wireshark tap (sudo tcpdump -i eth0 -w - > tcpdump.data) between my MacBook Pro and eero base station on ethernet, not wifi, the following packet showed up. It's an ethertype 0x9104. There's no such thing according to the official protocol list. The MAC 60:5f:8d:1f:36:52 is for the eero.

Does anyone know of this undocumented ethertype? The decode below of the 0x9104 is just a guess on my part.

Assuming this was put "on the wire" by the MacBook, I'm searching for where to post this to Apple knowledgeable people. Please shove me in the right direction, if you know. 68 years old and I still don't know enough.

** tcpdump HeaderPacket **
2020-04-21 09:47:14.827732
Packet octets 64, (0x40)
Packet length 64, (0x40)
Packet
. ffff ffff ffff 605f   8d1f 3652 9104 0260   5f8d 1f36 5200 0000   0000 0000 0000 0000
.                 ` _         6 R         `    _      6  R                             
. 0000 0000 0000 0000   0000 0000 0000 0000   0000 0000 0000 0000   0000 0000 0000 0000
.                                                                                      
. ** Ethernet **
. MAC source      255:255:255:255:255:255 (ff:ff:ff:ff:ff:ff)
. MAC destination 96:95:141:31:54:82 (60:5f:8d:1f:36:52)
. Length/Type     37,124, (0x9104)
. Packet
. . ffff ffff ffff 605f   8d1f 3652 9104 0260   5f8d 1f36 5200 0000   0000 0000 0000 0000
. .                 ` _         6 R         `    _      6  R                             
. . 0000 0000 0000 0000   0000 0000 0000 0000   0000 0000 0000 0000   0000 0000 0000 0000
. .                                                                                      
. . ** IEEE8029104 **
. . Code 2, (0x2)
. . MAC  96:95:141:31:54:82 (60:5f:8d:1f:36:52)
. . Packet
. . . 0260 5f8d 1f36 5200   0000 0000 0000 0000   0000 0000 0000 0000   0000 0000 0000 0000
. . .    `  _      6  R                                                                    
. . . 0000 0000 0000 0000   0000 0000 0000 0000   0000
. . .                                                 

A "tcpdump -r tcpdump.data" of the capture file produced this:

09:47:14.827732 60:5f:8d:1f:36:52 (oui Unknown) > Broadcast, ethertype Unknown (0x9104), length 64: 
    0x0000:  0260 5f8d 1f36 5200 0000 0000 0000 0000  .`_..6R.........
    0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0020:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0030:  0000                                     ..
1

Based on the Wireshark source here, this is a broadcast packet sent by the EERO:

0x9104 /* EERO: broadcast packets sent by EERO MESH AP's (not officially registered) */

| improve this answer | |
  • Thank you for this. My mystery is solved. – Chuck Apr 22 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.