[SLE] 14-byte MAC ?

[Pam R]

Running SuSEfirewall2 on a SuSE 8.0 box connected via eth1 to a cable network
(no local network running), I occasionally get messages like:

Jul 28 10:25:41 betsy kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth1 OUT=
MAC=01:00:5e:00:00:01:00:20:40:67:0f:eb:08:00 SRC=192.168.100.1 DST=224.0.0.1
LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2

Ethereal tells me these are IGMP messages from 192.168.100.1 to 224.0.0.1,
neither of which is anything like my ip address, which is fair enough and
doesn't worry me, but, why is the message showing a 14-byte MAC address
rather than the normal 6-byte variety?

[Joe & Sesil Morris (NTM)]

Post by Pam R
Jul 28 10:25:41 betsy kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth1 OUT=
MAC=01:00:5e:00:00:01:00:20:40:67:0f:eb:08:00 SRC=192.168.100.1 DST=224.0.0.1
LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2
Ethereal tells me these are IGMP messages from 192.168.100.1 to 224.0.0.1,
neither of which is anything like my ip address, which is fair enough and
doesn't worry me, but, why is the message showing a 14-byte MAC address
rather than the normal 6-byte variety?

I believe this is the IPV6 address. Check out ifconfig on your own MAC.
--
Joe & Sesil Morris
New Tribes Mission
Email Address: ***@ntm.org
Web Address: http://www.mydestiny.net/~joe_morris
Registered Linux user 231871
God said, I AM that I AM. I say, by the grace
God, I am what I am.

[Jim Cunning]

Post by Joe & Sesil Morris (NTM)

Post by Pam R
Jul 28 10:25:41 betsy kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth1 OUT=
MAC=01:00:5e:00:00:01:00:20:40:67:0f:eb:08:00 SRC=192.168.100.1 DST=224.0.0.1
LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2
Ethereal tells me these are IGMP messages from 192.168.100.1 to 224.0.0.1,
neither of which is anything like my ip address, which is fair enough and
doesn't worry me, but, why is the message showing a 14-byte MAC address
rather than the normal 6-byte variety?

I believe this is the IPV6 address. Check out ifconfig on your own MAC.

No, it's the complete ethernet MAC header: 6-byte dest. MAC, 6-byte source
MAC and 2-byte protocol ID. The protocol ID is 0800 (IP), the dest MAC is
a multicast destination, and the dest IP. address is the multicast address
for "all systems on this subnet." IGMP is the Internet Group Management
Protocol, which uses multicast for sending one copy of a packet to many
recipients. The source MAC probably is the address of your default
gateway.

Jim