Wireshark · Ethereal-users: Re: [Ethereal-users] Source MAC address while capturing with wireless device

[Guy Harris <gharris@xxxxxxxxx>]

Gentoo_Newbie wrote:

> I am doing captures with Ethereal with my wireless device. Can anyone 
> tell me why my source MAC address is aa:aa:03:00:00:00 ?

Because the driver is supplying packet headers that don't match the 
ARPHRD_ type, or is supplying a fake MAC address.  aa:aa:03 is the LLC 
header for a SNAP packet, and 00:00:00 is an OUI, which would follow the 
LLC header in a SNAP packet, and it'd indicate that what follows is an 
Ethernet type value.

Perhaps the driver or the card is supplying a fake Ethernet header, 
although, given that 802.11 packet have destination and source MAC 
addresses, I'm not sure why it's doing it in that fashion.

What type of wireless device do you have?  (I assume from your e-mail 
name that the machine is running Gentoo Linux.)