switchport is doing reconnaissance by sending bpdu for every 2seconds

switchport is doing reconnaissance by sending bpdu for every 2seconds

by Cyrus Lok on Monday, April 5, 2010 at 12:38am
I used wireshark to sniff my nic interface and here’s the results:

Frame 1 (60 bytes on wire, 60 bytes captured)
IEEE 802.3 Ethernet
Logical-Link Control
No. Time Source Destination Protocol Info
2 1.999575 00:23:5e:8c:d8:d3 Spanning-tree-(for-bridges)_00 STP Conf. Root = 32768/00:23:5e:8c:d8:d3 Cost = 0 Port = 0x8001

Frame 2 (60 bytes on wire, 60 bytes captured)
IEEE 802.3 Ethernet
Logical-Link Control
Spanning Tree Protocol
Protocol Identifier: Spanning Tree Protocol (0x0000)
Protocol Version Identifier: Spanning Tree (0)
BPDU Type: Configuration (0x00)
BPDU flags: 0x00
Root Identifier: 32768 / 00:23:5e:8c:d8:d3
Root Path Cost: 0
Bridge Identifier: 32768 / 00:23:5e:8c:d8:d3
Port identifier: 0x8001
Message Age: 0
Max Age: 20
Hello Time: 2
Forward Delay: 15

IEEE 802.3 Ethernet
Destination: Spanning-tree-(for-bridges)_00 (01:80:c2:00:00:00)
Source: 00:23:5e:8c:d8:d3 (00:23:5e:8c:d8:d3)
Length: 38
Trailer: 0000000000000000

This is the first frame(there are lots of them), this is the bpdu… lol… the switch port which my nic is connected to is actively sending bdpu “boomerang” to detect for other presence of switches and detecting a loop, if this bpdu comes back to the switchport interface then a loop is present.

Destination: Spanning-tree-(for-bridges)_00 (01:80:c2:00:00:00), this is the multicast address used for stp.

Advertisements
This entry was posted in Route. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s