On 1/31/2018 5:14 PM, Hante Meuleman wrote:
It is an 802.2 frame, more specifically a LLC XID frames. So why it exists? And more over, why would we crash as an result? Decoding info can be found here: https://www.cisco.com/c/en/us/support/docs/ibm-technologies/logical-link-control-llc/12247-45.html#con3 The frame was likely sent by the stack from remote site PC, should be possible to capture with tcpdump. I've seen these frames before, but don’t know what they are for. The frame appears to be correctly encoded. The ethertype, is not a type, but a len field. The only protocol with such a short len allowed is llc, see also
Could it be related to the fact that the interface is put in a bridge and hence the device is put in promiscuous mode? Anyway, I did not read anything about a firmware crash. Just that clients could not associate.
Regards, Arend
