wka

   1 #
   2 # Well-known addresses.
   3 #
   4 # Wireshark - Network traffic analyzer
   5 # By Gerald Combs <gerald [AT] wireshark.org>
   6 # Copyright 1998 Gerald Combs
   7 #
   8 # SPDX-License-Identifier: GPL-2.0-or-later
   9 #
  10 # The data below has been assembled from the following sources:
  11 #
  12 # Michael Patton's "Ethernet Codes Master Page" available from:
  13 # <http://www.cavebear.com/CaveBear/Ethernet/>
  14 # <ftp://ftp.cavebear.com/pub/Ethernet.txt>
  15 #
  16 # Microsoft Windows 2000 Server
  17 # Operating System
  18 # Network Load Balancing Technical Overview
  19 # White Paper
  20 #
  21 00-00-00-00-FE-21       Checkpoint-Uninitialized-Cluster-Member
  22 00-00-0C-07-AC/40       All-HSRP-routers
  23 00-00-5E-00-01/40       IETF-VRRP-VRID
  24 00-BF-00-00-00-00/16    MS-NLB-VirtServer
  25 00-E0-2B-00-00-00       Extreme-EDP
  26 # Extreme Encapsulation Protocol (basically EDP renamed)
  27 00-E0-2B-00-00-01       Extreme-EEP
  28 00-E0-2B-00-00-02       Extreme-ESRP-Client
  29 00-E0-2B-00-00-04       Extreme-EAPS
  30 00-E0-2B-00-00-06       Extreme-EAPS-SL
  31 00-E0-2B-00-00-08       Extreme-ESRP-Master
  32 01-00-0C-00-00/40       ISL-Frame
  33 01-00-0C-CC-CC-CC       CDP/VTP/DTP/PAgP/UDLD
  34 01-00-0C-CC-CC-CD       PVST+
  35 01-00-0C-CD-CD-CD       STP-UplinkFast
  36 01-00-0C-CD-CD-CE       VLAN-bridge
  37 01-00-0C-CD-CD-D0       GBPT
  38 01-00-0C-DD-DD-DD       CGMP
  39 01-00-10-00-00-20       Hughes-Lan-Systems-Terminal-Server-S/W-download
  40 01-00-10-FF-FF-20       Hughes-Lan-Systems-Terminal-Server-S/W-request
  41 01-00-1D-00-00-00       Cabletron-PC-OV-PC-discover-(on-demand)
  42 01-00-1D-00-00-05       Cabletron-PVST-BPDU
  43 01-00-1D-00-00-06       Cabletron-QCSTP-BPDU
  44 01-00-1D-42-00-00       Cabletron-PC-OV-Bridge-discover-(on-demand)
  45 01-00-1D-52-00-00       Cabletron-PC-OV-MMAC-discover-(on-demand)
  46 01-00-3C                Auspex-Systems-(Serverguard)
  47 01-00-5E/25             IPv4mcast
  48 01-00-81-00-00-00       Nortel-Network-Management
  49 01-00-81-00-00-02       Nortel-Network-Management
  50 01-00-81-00-01-00       Nortel-autodiscovery
  51 01-00-81-00-01-01       Nortel-autodiscovery
  52 #
  53 # As per
  54 #
  55 #       http://www.t11.org/ftp/t11/pub/fc/bb-5/08-334v0.pdf
  56 #
  57 # Broadcom "donated" one of their OUIs, 00-10-18, for use for
  58 # Fibre Channel over Ethernet, so we add entries for the
  59 # addresses in that document and a group of addresses for all
  60 # otherwise unlisted 01-10-18-XX-XX-XX addresses.
  61 #
  62 01-10-18-01-00-00       All-FCoE-MACs
  63 01-10-18-01-00-01       All-ENode-MACs
  64 01-10-18-01-00-02       All-FCF-MACs
  65 01-10-18-00-00-00/24    FCoE-group
  66 01-11-1E-00-00-01       EPLv2_SoC
  67 01-11-1E-00-00-02       EPLv2_PRes
  68 01-11-1E-00-00-03       EPLv2_SoA
  69 01-11-1E-00-00-04       EPLv2_ASnd
  70 01-11-1E-00-00-05       EPLv2_AMNI
  71 01-20-25/25             Control-Technology-Inc's-Industrial-Ctrl-Proto.
  72 01-80-24-00-00-00       Kalpana-Etherswitch-every-60-seconds
  73 01-80-C2-00-00-00/44    Spanning-tree-(for-bridges)
  74 01-80-C2-00-00-02       Slow-Protocols
  75 01-80-C2-00-00-03       Nearest customer bridge
  76 01-80-C2-00-00-0E       LLDP_Multicast
  77 01-80-C2-00-00-0F       Nearest non-TPMR bridge
  78 01-80-C2-00-00-10       Bridge-Management
  79 01-80-C2-00-00-11       Load-Server
  80 01-80-C2-00-00-12       Loadable-Device
  81 01-80-C2-00-00-13       IEEE-1905.1-Control
  82 01-80-C2-00-00-14       ISIS-all-level-1-IS's
  83 01-80-C2-00-00-15       ISIS-all-level-2-IS's
  84 01-80-C2-00-00-18       IEEE-802.1B-All-Manager-Stations
  85 01-80-C2-00-00-19       IEEE-802.11aa-groupcast-with-retries
  86 01-80-C2-00-00-1A       IEEE-802.1B-All-Agent-Stations
  87 01-80-C2-00-00-1B       ESIS-all-multicast-capable-ES's
  88 01-80-C2-00-00-1C       ESIS-all-multicast-announcements
  89 01-80-C2-00-00-1D       ESIS-all-multicast-capable-IS's
  90 01-80-C2-00-00-1E       Token-Ring-all-DTR-Concentrators
  91 01-80-C2-00-00-30/45    OAM-Multicast-DA-Class-1
  92 01-80-C2-00-00-38/45    OAM-Multicast-DA-Class-2
  93 01-80-C2-00-00-40       All-RBridges
  94 01-80-C2-00-00-41       All-IS-IS-RBridges
  95 01-80-C2-00-00-42       All-Egress-RBridges
  96 01-80-C2-00-00-45       TRILL-End-Stations
  97 01-80-C2-00-00-46       All-Edge-RBridges
  98 01-80-C2-00-01-00       FDDI-RMT-Directed-Beacon
  99 01-80-C2-00-01-10       FDDI-status-report-frame
 100 01-DD-00-FF-FF-FF       Ungermann-Bass-boot-me-requests
 101 01-DD-01-00-00-00       Ungermann-Bass-Spanning-Tree
 102 01-E0-52-CC-CC-CC       Foundry-DP
 103 # DOCSIS, defined in ANSI SCTE 22-1 2012
 104 01-E0-2F-00-00-01       DOCSIS-CM
 105 01-E0-2F-00-00-02       DOCSIS-CMTS
 106 01-E0-2F-00-00-03       DOCSIS-STP
 107
 108 # Extremenetworks in their infinite wisdom seems to use 02-04-94 (Vendor MAC XOR 02-00-00)
 109 # for their base mac address, thus colliding with MS-NLB 02-04/16 which Microsoft in their
 110 # infinite wisdom decided to use for MS-NLB.
 111 02-04-96-00-00-00/24    ExtremeNetworks
 112
 113 # Microsoft Network Load Balancing (NLB)
 114 # Actually, 02-01-virtualip to 02-20-virtualip will be used from server to rest-of-world
 115 # 02-bf-virtualip will be used from rest-of-world to server
 116 02-BF-00-00-00-00/16    MS-NLB-VirtServer
 117 02-01-00-00-00-00/16    MS-NLB-PhysServer-01
 118 02-02-00-00-00-00/16    MS-NLB-PhysServer-02
 119 02-03-00-00-00-00/16    MS-NLB-PhysServer-03
 120 02-04-00-00-00-00/16    MS-NLB-PhysServer-04
 121 02-05-00-00-00-00/16    MS-NLB-PhysServer-05
 122 02-06-00-00-00-00/16    MS-NLB-PhysServer-06
 123 02-07-00-00-00-00/16    MS-NLB-PhysServer-07
 124 02-08-00-00-00-00/16    MS-NLB-PhysServer-08
 125 02-09-00-00-00-00/16    MS-NLB-PhysServer-09
 126 02-0a-00-00-00-00/16    MS-NLB-PhysServer-10
 127 02-0b-00-00-00-00/16    MS-NLB-PhysServer-11
 128 02-0c-00-00-00-00/16    MS-NLB-PhysServer-12
 129 02-0d-00-00-00-00/16    MS-NLB-PhysServer-13
 130 02-0e-00-00-00-00/16    MS-NLB-PhysServer-14
 131 02-0f-00-00-00-00/16    MS-NLB-PhysServer-15
 132 02-10-00-00-00-00/16    MS-NLB-PhysServer-16
 133 02-11-00-00-00-00/16    MS-NLB-PhysServer-17
 134 02-12-00-00-00-00/16    MS-NLB-PhysServer-18
 135 02-13-00-00-00-00/16    MS-NLB-PhysServer-19
 136 02-14-00-00-00-00/16    MS-NLB-PhysServer-20
 137 02-15-00-00-00-00/16    MS-NLB-PhysServer-21
 138 02-16-00-00-00-00/16    MS-NLB-PhysServer-22
 139 02-17-00-00-00-00/16    MS-NLB-PhysServer-23
 140 02-18-00-00-00-00/16    MS-NLB-PhysServer-24
 141 02-19-00-00-00-00/16    MS-NLB-PhysServer-25
 142 02-1a-00-00-00-00/16    MS-NLB-PhysServer-26
 143 02-1b-00-00-00-00/16    MS-NLB-PhysServer-27
 144 02-1c-00-00-00-00/16    MS-NLB-PhysServer-28
 145 02-1d-00-00-00-00/16    MS-NLB-PhysServer-29
 146 02-1e-00-00-00-00/16    MS-NLB-PhysServer-30
 147 02-1f-00-00-00-00/16    MS-NLB-PhysServer-31
 148 02-20-00-00-00-00/16    MS-NLB-PhysServer-32
 149
 150 #       [ The following block of addresses (03-...) are used by various ]
 151 #       [ standards.  Some (marked [TR?]) are suspected of only being   ]
 152 #       [ used on Token Ring for group addresses of Token Ring specific ]
 153 #       [ functions, reference ISO 8802-5:1995 aka. IEEE 802.5:1995 for ]
 154 #       [ some info.  These in the Ethernet order for this list.  On    ]
 155 #       [ Token Ring they appear reversed.  They should never appear on ]
 156 #       [ Ethernet.  Others, not so marked, are normal reports (may be  ]
 157 #       [ seen on either).
 158 03-00-00-00-00-01       NETBIOS-# [TR?]
 159 03-00-00-00-00-02       Locate-Directory-Server # [TR?]
 160 03-00-00-00-00-04       Synchronous-Bandwidth-Manager-# [TR?]
 161 03-00-00-00-00-08       Configuration-Report-Server-# [TR?]
 162 03-00-00-00-00-10       Ring-Error-Monitor-# [TR?]
 163 03-00-00-00-00-10       (OS/2-1.3-EE+Communications-Manager)
 164 03-00-00-00-00-20       Network-Server-Heartbeat-# [TR?]
 165 03-00-00-00-00-40       (OS/2-1.3-EE+Communications-Manager)
 166 03-00-00-00-00-80       Active-Monitor # [TR?]
 167 03-00-00-00-01-00       OSI-All-IS-Token-Ring-Multicast
 168 03-00-00-00-02-00       OSI-All-ES-Token-Ring-Multicast
 169 03-00-00-00-04-00       LAN-Manager # [TR?]
 170 03-00-00-00-08-00       Ring-Wiring-Concentrator # [TR?]
 171 03-00-00-00-10-00       LAN-Gateway # [TR?]
 172 03-00-00-00-20-00       Ring-Authorization-Server # [TR?]
 173 03-00-00-00-40-00       IMPL-Server # [TR?]
 174 03-00-00-00-80-00       Bridge # [TR?]
 175 03-00-00-20-00-00       IP-Token-Ring-Multicast (RFC1469)
 176 03-00-00-80-00-00       Discovery-Client
 177 03-00-0C-00-00/40       ISL-Frame [TR?]
 178 03-00-C7-00-00-EE       HP (Compaq) ProLiant NIC teaming
 179 03-00-FF-FF-FF-FF       All-Stations-Address
 180 03-BF-00-00-00-00/16    MS-NLB-VirtServer-Multicast
 181 09-00-07-00-00-00/40    AppleTalk-Zone-multicast-addresses
 182                         # only goes through 09-00-07-00-00-FC?
 183 09-00-07-FF-FF-FF       AppleTalk-broadcast-address
 184 09-00-09-00-00-01       HP-Probe
 185 09-00-09-00-00-04       HP-DTC
 186 09-00-0D-00-00-00/24    ICL-Oslan-Multicast
 187 09-00-0D-02-00-00       ICL-Oslan-Service-discover-only-on-boot
 188 09-00-0D-02-0A-38       ICL-Oslan-Service-discover-only-on-boot
 189 09-00-0D-02-0A-39       ICL-Oslan-Service-discover-only-on-boot
 190 09-00-0D-02-0A-3C       ICL-Oslan-Service-discover-only-on-boot
 191 09-00-0D-02-FF-FF       ICL-Oslan-Service-discover-only-on-boot
 192 09-00-0D-09-00-00       ICL-Oslan-Service-discover-as-required
 193 09-00-1E-00-00-00       Apollo-DOMAIN
 194 09-00-2B-00-00-00       DEC-MUMPS?
 195 09-00-2B-00-00-01       DEC-DSM/DDP
 196 09-00-2B-00-00-02       DEC-VAXELN?
 197 09-00-2B-00-00-03       DEC-Lanbridge-Traffic-Monitor-(LTM)
 198 09-00-2B-00-00-04       DEC-MAP-(or-OSI?)-End-System-Hello?
 199 09-00-2B-00-00-05       DEC-MAP-(or-OSI?)-Intermediate-System-Hello?
 200 09-00-2B-00-00-06       DEC-CSMA/CD-Encryption?
 201 09-00-2B-00-00-07       DEC-NetBios-Emulator?
 202 09-00-2B-00-00-0F       DEC-Local-Area-Transport-(LAT)
 203 09-00-2B-00-00-10/44    DEC-Experimental
 204 09-00-2B-01-00-00       DEC-LanBridge-Copy-packets-(All-bridges)
 205 09-00-2B-01-00-01       DEC-LanBridge-Hello-packets-(All-local-bridges)
 206 09-00-2B-02-00-00       DEC-DNA-Level-2-Routing-Layer-routers?
 207 09-00-2B-02-01-00       DEC-DNA-Naming-Service-Advertisement?
 208 09-00-2B-02-01-01       DEC-DNA-Naming-Service-Solicitation?
 209 09-00-2B-02-01-09       DEC-Availability-Manager-for-Distributed-Systems-DECamds
 210 09-00-2B-02-01-02       DEC-Distributed-Time-Service
 211 09-00-2B-03-00-00/32    DEC-default-filtering-by-bridges?
 212 09-00-2B-04-00-00       DEC-Local-Area-System-Transport-(LAST)?
 213 09-00-2B-23-00-00       DEC-Argonaut-Console?
 214 09-00-4C-00-00-00       BICC-802.1-management
 215 09-00-4C-00-00-02       BICC-802.1-management
 216 09-00-4C-00-00-06       BICC-Local-bridge-STA-802.1(D)-Rev6
 217 09-00-4C-00-00-0C       BICC-Remote-bridge-STA-802.1(D)-Rev8
 218 09-00-4C-00-00-0F       BICC-Remote-bridge-ADAPTIVE-ROUTING
 219 09-00-56-FF-00-00/32    Stanford-V-Kernel,-version-6.0
 220 09-00-6A-00-01-00       TOP-NetBIOS.
 221 09-00-77-00-00-00       Retix-Bridge-Local-Management-System
 222 09-00-77-00-00-01       Retix-spanning-tree-bridges
 223 09-00-77-00-00-02       Retix-Bridge-Adaptive-routing
 224 09-00-7C-01-00-01       Vitalink-DLS-Multicast
 225 09-00-7C-01-00-03       Vitalink-DLS-Inlink
 226 09-00-7C-01-00-04       Vitalink-DLS-and-non-DLS-Multicast
 227 09-00-7C-02-00-05       Vitalink-diagnostics
 228 09-00-7C-05-00-01       Vitalink-gateway?
 229 09-00-7C-05-00-02       Vitalink-Network-Validation-Message
 230 09-00-87-80-FF-FF       Xyplex-Terminal-Servers
 231 09-00-87-90-FF-FF       Xyplex-Terminal-Servers
 232 0C-00-0C-00-00/40       ISL-Frame
 233 0D-1E-15-BA-DD-06       HP
 234 20-52-45-43-56-00/40    Receive
 235 20-53-45-4E-44-00/40    Send
 236 33-33-00-00-00-00       IPv6-Neighbor-Discovery
 237 33-33-00-00-00-00/16    IPv6mcast
 238 AA-00-03-00-00-00/32    DEC-UNA
 239 AA-00-03-01-00-00/32    DEC-PROM-AA
 240 AA-00-03-03-00-00/32    DEC-NI20
 241 AB-00-00-01-00-00       DEC-MOP-Dump/Load-Assistance
 242 AB-00-00-02-00-00       DEC-MOP-Remote-Console
 243 AB-00-00-03-00-00       DECNET-Phase-IV-end-node-Hello-packets
 244 AB-00-00-04-00-00       DECNET-Phase-IV-Router-Hello-packets
 245 AB-00-03-00-00-00       DEC-Local-Area-Transport-(LAT)-old
 246 AB-00-04-01-00-00/32    DEC-Local-Area-VAX-Cluster-groups-SCA
 247 CF-00-00-00-00-00       Ethernet-Configuration-Test-protocol-(Loopback)
 248 FF-FF-00-60-00-04       Lantastic
 249 FF-FF-00-40-00-01       Lantastic
 250 FF-FF-01-E0-00-04       Lantastic
 251
 252 FF-FF-FF-FF-FF-FF       Broadcast