Re: Unknown OUI's...

[<Tim.Poth () bentley com>]

This looks like Crestron
http://www.crestron.com/products/show_products.asp?type=commercial

Heidelbe has a few more hits so good luck there
http://standards.ieee.org/cgi-bin/ouisearch

I am way out of date on my cisco but I think you can look at what mac addresses are attached to what ports, might take 
some time but should be able to track down the port, unplug it and wait for someone to complain about something not 
working.

Good luck
tim

From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Phillip 
Nelson
Sent: Monday, November 09, 2009 10:14 AM
To: wireshark-users () wireshark org
Subject: [Wireshark-users] Unknown OUI's...

I just experienced a Vlan saturation event where the following source and destination MAC address were in all the 
packets causing the saturation. Does anyone recognize the OUI's of these two addresses? I have tried to look them up 
and can't find them anywhere.

The network has a 6509 for its core and 30 switches connected by fiber. Of the 30 switches, 11 are 4003's. Of the 
4003's, 5 were affected by the storm and only two were participating in the storm. The trace was taken from the Cisco 
6509 and the two participating Cisco 4003's. The broadcast storm was exactly the same between the two switches. We have 
ruled out all devices connected to the switches. We cannot find the MAC addresses anywhere on the network. We stopped 
the storm by resetting all the ports on the two 4003's.


Heidelbe_ab:99:6f        Crestron_eb:ac:cf             0x883d              Ethernet II

Phil Nelson
Arrow ECS
Infrastructure Engineer, Senior
28600 Fountain Pkwy
Solon, Ohio 44139

email- pnelson () arrow com<mailto:pnelson () arrow com>
w-216-332-3405
c-330-524-0463
f- 440-498-5178

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe