On 2016-03-20 00:53, James Knott wrote:
On 03/19/2016 07:13 PM, James Knott wrote:
On 03/19/2016 05:38 PM, Carlos E. R. wrote:
It might be my switch or my wifi router.
Switch mac "14:cc:20:ba:ba:bd". wifi mac "f8:1a:67:91:f4:22"
But the mac doesn't seem to match. Can you find the MAC in your arp cache or DHCP server? Of course, you can always fire up Wireshark to see the actual MAC address and then filter on it to see what IPv4 address might show up. Also, you can look up the MAC address to see who the manufacturer is. http://www.macvendorlookup.com/
Well, I posted already the output of "arp" and it is not there: Telcontar:~ # arp Address HWtype HWaddress Flags Mask Iface 192.168.74.119 ether 00:0c:29:5f:45:90 C vmnet8 router.valinor ether f8:8e:85:64:78:f2 C eth0 oldrouter.valinor ether f8:1a:67:91:f4:22 C eth0 AmonLanc.valinor ether 00:03:0d:05:17:fc C eth0 moria.valinor (incomplete) eth0 switchcreo ether 14:cc:20:ba:ba:bd C eth0 Telcontar:~ # The arp cache of the router is: IP address Flags HW Address Device 10.128.0.1 Complete e0:97:96:bc:89:ca eth0.3 192.168.1.15 Complete 00:03:0d:05:17:fc br0 192.168.1.52 Complete 80:96:ca:02:06:f9 br0 192.168.1.5 Complete f8:1a:67:91:f4:22 br0 192.168.1.132 Complete 5c:51:88:8f:3b:18 br0 192.168.1.201 Complete 90:ef:68:3a:0c:b8 br0 192.168.1.14 Complete 00:21:85:16:2d:0b br0 the switch is not even there. It should, I suppose.
To make things easier for you, the link local address fe80::8cae:84ff:fe43:27d4 works out to a MAC address of 8eae:8443:27d4. But it appears to be a locally assigned MAC address, which won't show up in a search. I can tell it's locally assigned because it starts off with "8e", which would be "8c" otherwise. As 8e is an even number, the 8th bit is a 0. If it was a 1, then it would be a multicast MAC address.
Well, I believe it is the "switchcreo" (switch, I believe) - see my response to Per. But its MAC is 14:cc:20:ba:ba:bd
You can find info on MAC addresses here: https://en.wikipedia.org/wiki/MAC_address
BTW, that 7th bit can make things confusing. In the MAC, it's used to indicate locally assigned MACs. Then in converting to IPv6 link local address, what ever it is gets inverted. The reason for this is so that a locally assigned address will start off with a string of zeros.
Ah.
Bottom line, something is generating a locally assigned address. You'll have to do some detective work to find out what. Since those packets are happening frequently, just set up Wireshark to display only them and then start disconnecting things until they stop.
I will not be able to see them, and also, I don't what packages to look for. ISP--fibre--[Main router]---[switch]---[R-W-A.P.]-- R-W-A.P. is Router used as "WiFi-Access Point" My computer is connected to the switch. If, as I believe, the traffic is between the router and the R-W-A.P. (see Florian post and my response), the switch may not send those packages to my computer. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)