Wireshark · Ethereal-users: Re: [Ethereal-users] MS-based Ethertype Decode

["M.C. van den Bovenkamp" <marco@xxxxxxxxxxxxxxxxxxx>]

Scott Fringer wrote:

>   I'm seeing a good deal (from one host) of traffic of Ethertype x886f
> sourced from MAC address 02:01:00:00:00:00 destined to the local

That's MS Network Load Balancing heartbeat.

> site turn up no information on this Ethertype or MAC address.

But a Google search would have; see for instance
http://archives.neohapsis.com/archives/incidents/2000-12/0095.html

> The user
> of the system is not aware of anything 'enabled' on his Win2000 system
> that could be generating this traffic.

Look for the above.

		Regards,

			Marco.