• February 22, 2018, 01:35:37 PM
Welcome, Guest. Please login or register. Registration is free.
Did you miss your activation email?

Author Topic: Wellfleet Breath Of Life packets  (Read 989 times)

0 Members and 1 Guest are viewing this topic.

Offline DarkLurker

  • Rookie
  • **
  • Posts: 5
Wellfleet Breath Of Life packets
« on: November 29, 2017, 04:21:52 PM »
Hi All,

This is just an idle-curiosity question that came up when I was doing Wireshark captures on my core 5530 switch yesterday.  Does anybody know much about the WellFleet Breath Of Life packets?

Google didn't have much to offer on it, other than it came from WellFleet/Bay Networks and is used to "detect a transmitter jam".  At first, I thought maybe that's what Avaya/Nortel code uses for BPDUs, but then realized I don't run BPDU-filtering on my core box, so that probably isn't it (or maybe it always sends them, but only shutsdown the port if it's filtering?).

They show up in the capture with great regularity - every 0.500 seconds to the thousandth of a second.

Anybody know any more about these?  Like I said, I'm just asking out of idle curiosity - a dusty old layer 2 protocol that isn't talked about much on the Internets.  That's gotta be something cool.

Thanks,
Dave


Offline Michael McNamara

  • Administrator
  • Hero Member
  • *****
  • Posts: 3834
    • michaelfmcnamara
    • Michael McNamara
Re: Wellfleet Breath Of Life packets
« Reply #1 on: November 30, 2017, 01:05:59 PM »
What's the ether type of the frames in question?

BOFL was used over point to point serial links. It's likely VLACP or SONMP/NDP (CDP)... your using the latest release of WireShark?

Cheers!
We've been helping network engineers, system administrators and technology professionals since June 2009.
If you've found this site useful or helpful, please help me spread the word. Link to us in your blog or homepage - Thanks!

Offline DarkLurker

  • Rookie
  • **
  • Posts: 5
Re: Wellfleet Breath Of Life packets
« Reply #2 on: December 01, 2017, 11:13:27 AM »
Hi Michael,

Wireshark is relatively recent - installed this past summer.  I'm not running VLACP or anything peculiar on the port I was capturing from.  It's just a standard member port, and I only had it in a single VLAN during the capture.  I was using a copper SFP -  my core is a 5632, not a 5530 like I said in the first post (d'oh), hence the need for a copper SFP (much cheaper than a fiber USB adapter for the laptop. ;) ).

It shows the frames are Ethernet II. 


What I found interesting was the source and destination MACs - 00:d9:21 and 01:d9:21.  As far as I can tell, they aren't in any of the reserved ranges, but aren't registered either - none of the OUI lookup sites, including the IEEE list at http:\\standards-oui.ieee.org/oui.txt, shows them as belonging to anyone at all (not Wellfleet, Bay, Nortel, etc.).  So it's like whoever wrote the code just made up an address to use for it.  Or maybe it used to belong to someone but doesn't anymore.

So, eh, I dunno.  Just a curiosity, I guess.

Offline Michael McNamara

  • Administrator
  • Hero Member
  • *****
  • Posts: 3834
    • michaelfmcnamara
    • Michael McNamara
We've been helping network engineers, system administrators and technology professionals since June 2009.
If you've found this site useful or helpful, please help me spread the word. Link to us in your blog or homepage - Thanks!

Offline DarkLurker

  • Rookie
  • **
  • Posts: 5
Re: Wellfleet Breath Of Life packets
« Reply #4 on: December 01, 2017, 01:21:25 PM »
Ah, thanks Michael.  Yeah, that switch does have an MLT on it and SLPP is enabled. 

So the switch sends SLPP packets out all of its ports, even if they aren't in the MLT? (the port I was in was not an MLT member)  I didn't know it did that.