0

I have recently started a networking course and acquired an old HP ProCurve 1810G-24 Switch to play about with, which I have updated to the latest firmware. I'm using Wireshark to monitor the traffic, with my laptop being the only device connected to the switch.

I notice every 5 seconds there is data being broadcast which reports to be the protocol IEEE802a. The source and destination are two different MAC addresses which neither of them are the laptop MAC address but are the make of the switch.

Src: ProCurve_8a:40:e2 Dst: HewlettP_09:13:a6 Protocol: IEEE802a

The 'Info' field shows 'OUI' data of random electronic companies 51 times with a different PID then changes to a different company.

What is the purpose of this data? Is it random data used as a keep-live or to see if the connection is still live?

enter image description here

Improve this question

1 Answer 1

Reset to default
0

You seem to have activated loop protection on that port.

Those are the probing frames - if one of them returns to the switch that port is deactivated, depending on configuration.

IEEE 802a means that those frames use an extended EtherType (0x003) by HPE. If weird OUIs show up that might indicate an outdated firmware version, it doesn't happen on my gear.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.