Results 1 to 4 of 4
  1. #1

    Please help me about Lan broadcast

    i use the sniffer tool in Lan,find the large longs broadcast source MAC is 020100000000,
    protocol is 886F(unknown),longth 1510, please ask it's common broadcast? it is a virus ?

  2. #2
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    deadforg: Can you post a complete packet dump plz. Sanitize it if necessary of course.
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  3. #3
    Senior Member
    Join Date
    Nov 2002
    Here is the answer:

    - 886F ethertype owns to Microsoft
    information from IEEE
    Microsoft Corporation
    Redmond, WA
    - Then a quick research on M$ site gives you the information that this ethertype is used for servers (2K) load balancing with a cluster of server

    information from M$
    Network Load Balancing scales the performance of a server-based program, such as a Web server, by distributing its client requests among multiple servers within the cluster. With Network Load Balancing, each incoming IP packet is received by each host, but only accepted by the intended recipient. The cluster hosts concurrently respond to different client requests, even multiple requests from the same client. For example, a Web browser may obtain the various images within a single Web page from different hosts in a load-balanced cluster. This speeds up processing and shortens the response time to clients.
    Network Load Balancing's heartbeat messages are assigned an ether type-value of hexadecimal 886F. The default period between sending heartbeats is one second, and this value can be adjusted with the AliveMsgPeriod registry parameter.
    [shadow] SHARING KNOWLEDGE[/shadow]

  4. #4
    thanks ,may be runing Network Load Balancing

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts