hdm / mac-ages

MAC address age tracking
Other
574 stars 37 forks source link

Remove entries for meta addresses #2

Closed hdm closed 5 years ago

hdm commented 5 years ago

Entries like the following originally came from Wireshark (Ethereal), but do not represent actual allocations, and should be removed. Additionally, these entries are ambiguous given the default mask (/24).

00-E0-2B-00-00-01       Extreme-EEP
00-E0-2B-00-00-02       Extreme-ESRP-Client
00-E0-2B-00-00-04       Extreme-EAPS
00-E0-2B-00-00-06       Extreme-EAPS-SL
00-E0-2B-00-00-08       Extreme-ESRP-Master
01-00-5E/25 IPv4mcast
01-80-C2-00-00-30/45    OAM-Multicast-DA-Class-1
01-80-C2-00-00-38/45 OAM-Multicast-DA-Class-2
09-00-07-00-00-00/40 AppleTalk-Zone-multicast-addresses
09-00-0D-00-00-00/24 ICL-Oslan-Multicast
33-33-00-00-00-00/16 IPv6mcast
erik4711 commented 5 years ago

The 00e02b network in Wireshark's "manuf" file contains the proper /24 mask range:

'$ fgrep -i "00:e0:2b" manuf
00:E0:2B    ExtremeN    Extreme Networks, Inc.

The other 00e02b entries are probably from Wireshark's "wka" file, where /48 is default unless a mask is explicitly stated:

$ fgrep -i "00-e0-2b" wka
00-E0-2B-00-00-00   Extreme-EDP
00-E0-2B-00-00-01   Extreme-EEP
00-E0-2B-00-00-02   Extreme-ESRP-Client
00-E0-2B-00-00-04   Extreme-EAPS
00-E0-2B-00-00-06   Extreme-EAPS-SL
00-E0-2B-00-00-08   Extreme-ESRP-Master

These entries seem to have been interpreted as /24 by mac-ages. But the 00e02b network isn't the only one that has been misinterpreted in mac-ages. In total, there seems to be 141 /48 masks in wka that have made it into mac-ages as /24 masks:

$ egrep "(\-([0-9A-F]){2}){5}\s" wka | wc -l
141