[TriLUG] IPTables appends 08:00 to MAC address field?

[crimsun at fungus.sh.nu]

On Mon, Dec 15, 2003 at 11:04:52AM -0500, Jeff Bollinger wrote:
> MAC=00:0d:61:C5:76:b1:00:04:75:a0:d1:db:08:00 SRC=x.x.x.x DST=x.x.x.x 
> 
> The MAC address field seems to be divided into
> 
> source: 00:0d:61:C5:76:b1
> dest:   00:04:75:a0:d1:db
> 
> and an 08:00 on the end (2048 in decimal).  What do these extra two 
> bytes signify?

They specify the link layer type. 08:00 is ethernet.

-D

-- 
Daniel T. Chen          crimsun at fungus.sh.nu
GPG key:   www.sh.nu/~crimsun/pubkey.gpg.asc
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://www.trilug.org/pipermail/trilug/attachments/20031215/4dc1a4c2/attachment.pgp>