Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Weird Null Packets

From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Wed, 19 Jan 2011 12:46:18 -0500
On 1/19/2011 10:54 AM, Michael Glenn wrote:
Hi.

I'm getting the weirdest packets trickling out of a network segment,
and I'm trying to determine if the switch is dying, or if Microsoft
has struck again (I've been installing some Win7 PCs on that
segment).

The packets are pretty-much nothing but a slew of zeroes; Wireshark
guessed them to be FibreChannel traffic, but no such hardware on the
segment. I'm attaching an extracted packet capture.


What hardware/OS/... are you using to capture these frames ?

Are you also getting good frames using the same setup ??

Wireshark shows the frames as being all zeros with no ethernet address, etc. which makes me wonder if these frames are actually really "on the wire".

Do do get the same results using an alternate capture program (windump for Windows or tcpdump for *nix) ?

The same with an alternate capture platform ? (eg: Windows iso *nix)?