FC malformed packet - no source addr or dest addr. All zeros

Is this a real FC frame, or do you just think it is a FC frame, because Wireshark show FC as protocol?

Wireshark shows frames with an ethertype of 0 as FC. See Bug 8256

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8256

So, this could be just a malformed ethernet frame (lots of zeros at the beginning - maybe caused by a broken NIC) and Wireshark shows it as FC.

Is it possible to post a sample capture file (Google Drive, Dropbox, etc.)?

How should I proceed to troubleshoot this issue?

First I suggest to figure out if it it makes sense to see a FC (over Ethernet) frame on the link where you captured the traffic.

• If it makes sense: You need to figure out where the frame was originated. Take a look at the rest of the frame and check if there are any 'known' byte sequences that might help.
• If it makes no sense: It could be just a damaged ethernet frame and Wireshark shows it as FC (see bug above). In that case you need to find the broken NIC/switch port that generated the packet.

Regards
Kurt