Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: Re: [Ethereal-users] Unrecognized source

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 31 Dec 2004 18:41:56 -0800
Gerry Roston wrote:

When I run ethereal from my Wndows XP computer on home network (I have a netgear router that provides DHCP and DNS services), I see a broadcast packet every 2.5 seconds from source ximetaTe_18:02:a2 using protocol 0x88ad. I have googled this, but have not found anything. Could some one please tell me what this is?

Perhaps somebody from Ximeta (or XiMeta, or XIMETA, or however they capitalize it) can.

The IEEE list of registered Ethernet types at

	http://standards.ieee.org/regauth/ethertype/eth.txt

says 88AD is assigned to XiMeta Technology Americas Inc., with the comment

We are manufacturing a series of devices that are connected to the Ethernet requiring secure data transmission. Because of the security reasons, the communication between
	the devices is done through a proprietary
	communication protocol instead of well known
	protocols such as IP.  We therefore need
	an Ethertype Field for the Ethernet frame
	to embed our proprietary communication protocol.

The "proprietary" part suggests that some of the security might be security-through-obscurity - "we're secure because we don't use that insecure TCP/IP!", as suggested by their page at

	http://www.ximeta.com/technology/ndas/index.php

so perhaps they won't tell you what it is, however.

Do you have one of their devices?

	http://www.ximeta.com/

If so, it's probably sending out packets looking for a server, or something such as that.