Re: [load balancing] Malformed frames from ServerIron?

From: Kelly Brown <kbbrownIZZATanonymizerinc.com>
Date: Tue May 31 2005 - 12:21:30 EDT

Those mac addresses are made up by the server iron. You can try doing
an arping and see who responds. I'm not sure why the SI's do this. I
think it creates a mac for each vip...

-K

Patrick Zurek wrote:

>Hi all,
>I have two ServerIron EGx2s that just recently have had both of their
>WSM modules begin to fail, they would crash sporadically and require a
>reboot. I'm in the process of getting them swapped out with Foundry
>TAC (SLOW). In the meantime, I've noticed the following traffic being
>broadcast on the network, approx. 14 or so of these type 885a frames
>per second. Unfortunately, I can't remember if I saw this before the
>problems began.
>
>10:48:03.548698 2:c:db:72:3:f 0:e0:52:0:0:0 885a 60:
> 0102 001f 0400 00ff 0101 000c db72 0300
> 00ae 5d1e 0000 0000 0000 0000 0000 0000
> 0000 0000 0000 0000 0000 0000 0000
>10:48:03.548704 0:c:db:72:3:20 0:e0:52:0:0:0 885a 60:
> 0102 001e 0500 0101 80ae 5d28 0105 5000
> 00ae 5d1e 0000 0000 0000 0000 0000 0000
> 0000 0000 0000 0000 0000 0000 0000
>10:48:03.748683 2:c:db:72:3:10 0:e0:52:0:0:0 885a 60:
> 0102 001f 0400 00ff 0101 000c db72 0300
> 0000 0000 0000 0000 0000 0000 0000 0000
> 0000 0000 0000 0000 0000 0000 0000
>10:48:03.748694 0:c:db:72:3:20 0:e0:52:0:0:0 885a 60:
> 0102 001e 0500 0101 80ae 5d28 0105 5000
> 0000 0000 0000 0000 0000 0000 0000 0000
> 0000 0000 0000 0000 0000 0000 0000
>
>
>The second and fourth frames look like normal heartbeats between two
>SIs in an active-active configuration. But the first and third frames
>are puzzling me. The prefix 02:0c:db isn't delegated:
>http://www.coffer.com/mac_find/?string=0%3Ac%3Adb and it is not
>configured on any device on the network. Also, there is always an
>even number of these packets being broadcast. One with a (presumed)
>bogus source address for each "normal" frame.
>
>Has anyone seen this before or have any idea what these are?
>
>Thanks
>
>____________________
>The Load Balancing Mailing List
>Unsubscribe: mailto:majordomo@vegan.net?body=unsubscribe%20lb-l
>Archive: http://vegan.net/lb/archive
>LBDigest: http://lbdigest.com
>MRTG with SLB: http://vegan.net/MRTG
>Hosted by: http://www.tokkisystems.com
>
>

____________________
The Load Balancing Mailing List
Unsubscribe: mailto:majordomo@vegan.net?body=unsubscribe%20lb-l
Archive: http://vegan.net/lb/archive
LBDigest: http://lbdigest.com
MRTG with SLB: http://vegan.net/MRTG
Hosted by: http://www.tokkisystems.com
Received on Tue May 31 13:30:01 2005

This archive was generated by hypermail 2.1.8 : Tue May 31 2005 - 13:38:02 EDT