0x9000

[o.hassairi]

hello

some times, when i make a lan capture, i find an ethernet trafic having the ethertype field:0x9000.

it's not DoDIP, it's not ARP but it's 0x9000.

has any one any idea about this trafic ? what is it exactelly ? and why does it exist?

thanks

[deilert]

could it be McAfee's NetShield anti-virus for Novell

[o.hassairi]

i don't think so, because the source MAC address = destination MAC Address = MAC address of a cisco router 1720. could it be cdp ?

[liviu.gheorghe]

It's not CDP. CDP is multicast to MAC address 0100.0ccc.cccc, source MAC address is the router who sent the CDP frame.

Ethertype 0x9000 means Enet config test. See the link below:

http://www.cisco.com/en/US/products/hw/wireless/ps458/products_configuration_guide_chapter09186a008007f768.html

Cheers

[o.hassairi]

ah!!!!

thanks a lot for your help.