Subject: Re: mrouted and Old IP Broadcast address

From: Bill Fenner <[email-masked]>
Date: Mon, 10 Mar 1997 11:47:38 PST

Can you capture the actual data portion of the packets?  Without knowing
what type of packets they are, there's no way of determining what part of
mrouted might have accidentally sent them.

  Bill

---

From: D E PRICE <[email-masked]>
Date: Tue, 11 Mar 1997 11:31:54 +0000

Dear Bill,
	Thnaks for the reply. I'll capture some
packets and email to you.

Dave

---

From: D E PRICE <[email-masked]>
Date: Tue, 11 Mar 1997 18:38:29 +0000

Dear Bill and Friends,

	Re my machine generating traffic to the old broadcast
address of 0.0.0.0, I have now captured a packet etc.

/usr/sbin/snoop -v -x 0 -i old*
ETHER:  ----- Ether Header -----
ETHER:  
ETHER:  Packet 1 arrived at 14:11:37.84
ETHER:  Packet size = 42 bytes
ETHER:  Destination = ff:ff:ff:ff:ff:ff, (broadcast)
ETHER:  Source      = 8:0:20:d:87:c5, Sun
ETHER:  Ethertype = 0800 (IP)
ETHER:  
IP:   ----- IP Header -----
IP:   
IP:   Version = 4
IP:   Header length = 20 bytes
IP:   Type of service = 0x00
IP:         xxx. .... = 0 (precedence)
IP:         ...0 .... = normal delay
IP:         .... 0... = normal throughput
IP:         .... .0.. = normal reliability
IP:   Total length = 28 bytes
IP:   Identification = 46858
IP:   Flags = 0x4
IP:         .1.. .... = do not fragment
IP:         ..0. .... = last fragment
IP:   Fragment offset = 0 bytes
IP:   Time to live = 1 seconds/hops
IP:   Protocol = 2 (IGMP)
IP:   Header checksum = f678
IP:   Source address = 193.60.11.33, trollope.dcs.aber.ac.uk
IP:   Destination address = 0.0.0.0, OLD-BROADCAST
IP:   No options
IP:   

           0: ffff ffff ffff 0800 200d 87c5 0800 4500    ........ .....E.
          16: 001c b70a 4000 0102 f678 c13c 0b21 0000    ....@....x.<.!..
          32: 0000 1600 e9ff 0000 0000                   ..........

Has anybody any idea what is happening??

Thanks,

Dave Price