I run wireshark and it captures packets 14% of my all traffic with src 00:00:00:00:00:00 dst 00:00:00:00:00:00 Protocol 0x0000 Length 60 Info Ethernet II please tell me why I'm getting these Packets.
asked 12 Feb '17, 02:33
edited 12 Feb '17, 11:23
Guy Harris ♦♦
Welcome to ask.wireshark.org. Obviously the strange Ethernet frames consists of a series of zero bytes. These frame should not be seen for a number of reasons:
It is important to find out, if the frames are generated by one individual system, or if they are generated by multiple systems.
Solution 1: Only one system is causing the frames
If you have a managed switch I highly recommend to check system log and the status of switch. On a Cisco switch the most helpful command would be
The output should reveal the port, where the network frame entered the network. You might want to replace the network card or update the driver for the system, that is connected to the port.
Solution 2: Multiple systems are generating the frames
It could be, that multiple systems generate the frame. Again, a faulty driver would be the most likely root cause. This causes a lot of confusion for the switch: The forwarding engine would assume, that the MAC address 00-00-00-00-00-00 would be jumping from one port to another. This would be logged in the switches log buffer. The log file from the switch could also show a message like
The switch will always expect, that frames from any MAC address will constantly come in from the same port. Your system 00-11-22-33-44-55 will always be on port Fa 0/2, unless
The whole network can become very unstable, if MAC addresses appear on different ports without a change in the spanning tree.
Solution 3: Faulty network equipment
Of course, it is also possible, that the switch generates the frames without reason. Please connect the suspicious computer to a different switch and verify, if the frames still show up.
Solution 4: Problem in the virtualization software
There seems to be a bug in certain VMware installations, that cause these frames. Please check this thread from 2008 in the VMware community
answered 12 Feb ‘17, 09:46