Wireshark-users: Re: [Wireshark-users] Unknown OUI's...

From: Alan Emery <ademery@xxxxxxxxxx>
Date: Mon, 9 Nov 2009 09:44:24 -0600

Crestron is an A/V and lighting control company. It supports sending control information between devices over Ethernet. For example the products on this page use Ethernet.

As to Heildelbe there are several possibilities in the IEEE oui file located at http://standards.ieee.org/regauth/oui/oui.txt . By looking at the 3 byte prefix on the MAC address shown as Heidelbe_ab:99:6f you should be able to tell which one it might be.

Alan Emery

IBM Global Solution Center
Coppell, TX
ademery@xxxxxxxxxx

wireshark-users-bounces@xxxxxxxxxxxxx wrote on 11/09/2009 09:14:16 AM:

> [image removed]
>
> [Wireshark-users] Unknown OUI's...
>
> Phillip Nelson
>
> to:
>
> wireshark-users
>
> 11/09/2009 09:17 AM
>
> Sent by:
>
> wireshark-users-bounces@xxxxxxxxxxxxx
>
> Please respond to Community support list for Wireshark
>
> I just experienced a Vlan saturation event where the following
> source and destination MAC address were in all the packets causing
> the saturation. Does anyone recognize the OUI's of these two
> addresses? I have tried to look them up and can't find them anywhere.
>  
> The network has a 6509 for its core and 30 switches connected by
> fiber. Of the 30 switches, 11 are 4003's. Of the 4003's, 5 were
> affected by the storm and only two were participating in the storm.
> The trace was taken from the Cisco 6509 and the two participating
> Cisco 4003's. The broadcast storm was exactly the same between the
> two switches. We have ruled out all devices connected to the
> switches. We cannot find the MAC addresses anywhere on the network.
> We stopped the storm by resetting all the ports on the two 4003's.
>  
>  
> Heidelbe_ab:99:6f        Crestron_eb:ac:cf             0x883d      
> Ethernet II
>  
> Phil Nelson
> Arrow ECS
> Infrastructure Engineer, Senior
> 28600 Fountain Pkwy
> Solon, Ohio 44139
>  
> email- pnelson@xxxxxxxxx
> w-216-332-3405
> c-330-524-0463
> f- 440-498-5178
>  ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe