Subject: Re: rx_dropped packets stop with tcpdump running

From: Bill Fink <[email-masked]>
Date: Sun, 22 Apr 2012 01:13:54 -0400

On Fri, 20 Apr 2012 17:25:28 +0200, Marco Berizzi wrote:

> [email-masked] wrote:
> > 0x886d or 0x86DD? That second one is IPv6, you might just need to load the module.
> 
> here is the tcpdump:
> 
> 17:23:25.561398 00:19:99:90:ba:72 > ff:ff:ff:ff:ff:ff, ethertype Unknown (0x886d), length 64: 
>         0x0000:  0001 0001 000c 24e2 0001 0019 9990 ba72  ......$........r
>         0x0010:  0000 0500 2304 6364 726f 447b d700 80f8  ....#.cdroD{....
>         0x0020:  ffff 20d1 b631 80fa ffff e02b fb30 80fa  .....1.....+.0..
>         0x0030:  ffff                                     ..
> 17:23:25.561402 00:19:99:90:ba:73 > ff:ff:ff:ff:ff:ff, ethertype Unknown (0x886d), length 64: 
>         0x0000:  0001 0001 000c 24e2 0002 0019 9990 ba72  ......$........r
>         0x0010:  6700 5400 6800 7200 6500 7300 6800 6f00  g.T.h.r.e.s.h.o.
>         0x0020:  6c00 6400 0000 3700 3200 0000 0000 0000  l.d...7.2.......
>         0x0030:  0000                                     ..

FYI, a Google search for "ethertype 886d" revealed that this is
supposedly an Intel ANS probe.  See:

  http://fixunix.com/networking/337443-packets-broadcasting-every-second.html

						-Bill