Am Mon, 2003-05-19 um 20.27 schrieb Maciej Soltysiak: > Hi, > > > MAC=00:a0:cc:28:56:c4:00:09:b6:13:9a:7c:08:00 > There are 12 octets here, so it is: > Source MAC: 00:a0:cc:28:56:c4:00 > Dest MAC: 09:b6:13:9a:7c:08:00 Unfortunately this is not fully correct. The first 12 octetts are the MAC addresses. The last two specify the protocol. All in all it is the *whole* ethernet header: Source MAC 00:a0:cc:28:56:c4 Dest MAC 00:09:b6:13:9a:7c Protocol 08:00 (see RFC894) Cheers, Ralf -- Ralf Spenneberg RHCE, RHCX Book: Intrusion Detection für Linux Server http://www.spenneberg.com IPsec-Howto http://www.ipsec-howto.org Honeynet Project Mirror: http://honeynet.spenneberg.org
