What are these frames for? 0x6002

[d.wingert]

Hello everybody,

Can somebody shed any light on this? Or even know who to alter this behaviour(filter, disable, etc)?

I have a capture running on an ethernet interface of a 3640 with IOS c3640-jk9o3s-mz.123-14.T7.bin

CDP and keepalives are disabled, no routing, no ip addresses configured.

Still Wireshark shows me that the interface is sending frames with a protocol id of 0x6002 (DEC DNA Remote Console) around every 515 to 705 seconds.

What are these frames for?

Regards,

Dirk

[David Stanford]

These are DECNET MOP packets

If you do a "no mop enable" on the interface do these packets stop?

[d.wingert]

Hello David,

It does indeed! Thank you very much!

Now to my next question :-)

Why does a pretty recent IOS like c3640-jk9o3s-mz.123-14.T7.bin still have the advertisement of these frames as a default?

Considering things like security and running extra processes etc; shouldn't stuff like this be removed from the default behaviour of the IOS?

Regards, Dirk

[DaddyGoat]

I'm definitely pretty late to your answer but just in case anyone else may be looking. Cisco believes in legacy. They love to have legacy commands and as they get depreciated they go through various steps slowly remove those old features. This works really great to steer person's who use to their IOS into finally lessening their use of the command until eventually they remove it completely.  

Commands like show BGP and terminal monitor are examples of commands that are in the process of being phased out of IOS-XE.