Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: Re: [Ethereal-users] Rookie question

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: ronnie sahlberg <ronniesahlberg@xxxxxxxxx>
Date: Tue, 14 Jun 2005 09:01:56 +1000
On 6/14/05, Linux Hawk <linux_hawk@xxxxxxxxx> wrote:

> My question at this point is why in the main window of
> Ethereal why does it give something like # # # # # . 1
> instead of a IP Address?

Because it is not an IP packet. It is an AppleTalk packet.

> The Source said it is from a Sercom product.

sercom appears to be a company selling measurement instruments. Maybe
you have such equipment in your network.  Maybe for some weird reason
these devices implement AppleTalk?

> 
> I get 2 different Mac addresses.
> I can locate the Source mac address on our Network
> Switch.
> I found which port it is, but our building is all
> mislabeled

You should then make documenting your network topology your highest priority.
You should ALWAYS have a fully documented topology diagram with
detailed and accurate and up to date showing every single wire.

If you dont want to follow the cables what you can do and IFF you are
ABSOLUTELY sure the device is not vital for running your production
network (like being the uplink router):
Pull that cable from the switch and wait for someone to start screaming.