[load balancing] Malformed frames from ServerIron?

From: Patrick Zurek <uofitornIZZATgmail.com>
Date: Tue May 31 2005 - 11:27:03 EDT

Hi all,
I have two ServerIron EGx2s that just recently have had both of their
WSM modules begin to fail, they would crash sporadically and require a
reboot. I'm in the process of getting them swapped out with Foundry
TAC (SLOW). In the meantime, I've noticed the following traffic being
broadcast on the network, approx. 14 or so of these type 885a frames
per second. Unfortunately, I can't remember if I saw this before the
problems began.

10:48:03.548698 2:c:db:72:3:f 0:e0:52:0:0:0 885a 60:
                         0102 001f 0400 00ff 0101 000c db72 0300
                         00ae 5d1e 0000 0000 0000 0000 0000 0000
                         0000 0000 0000 0000 0000 0000 0000
10:48:03.548704 0:c:db:72:3:20 0:e0:52:0:0:0 885a 60:
                         0102 001e 0500 0101 80ae 5d28 0105 5000
                         00ae 5d1e 0000 0000 0000 0000 0000 0000
                         0000 0000 0000 0000 0000 0000 0000
10:48:03.748683 2:c:db:72:3:10 0:e0:52:0:0:0 885a 60:
                         0102 001f 0400 00ff 0101 000c db72 0300
                         0000 0000 0000 0000 0000 0000 0000 0000
                         0000 0000 0000 0000 0000 0000 0000
10:48:03.748694 0:c:db:72:3:20 0:e0:52:0:0:0 885a 60:
                         0102 001e 0500 0101 80ae 5d28 0105 5000
                         0000 0000 0000 0000 0000 0000 0000 0000
                         0000 0000 0000 0000 0000 0000 0000

The second and fourth frames look like normal heartbeats between two
SIs in an active-active configuration. But the first and third frames
are puzzling me. The prefix 02:0c:db isn't delegated:
http://www.coffer.com/mac_find/?string=0%3Ac%3Adb and it is not
configured on any device on the network. Also, there is always an
even number of these packets being broadcast. One with a (presumed)
bogus source address for each "normal" frame.

Has anyone seen this before or have any idea what these are?

Thanks

____________________
The Load Balancing Mailing List
Unsubscribe: mailto:majordomo@vegan.net?body=unsubscribe%20lb-l
Archive: http://vegan.net/lb/archive
LBDigest: http://lbdigest.com
MRTG with SLB: http://vegan.net/MRTG
Hosted by: http://www.tokkisystems.com
Received on Tue May 31 12:35:32 2005

This archive was generated by hypermail 2.1.8 : Tue May 31 2005 - 13:24:44 EDT