Understanding IPv6: A Sniffer Full Of 3s (Part 3 of 7)
“What the heck?” Yup, that pretty much summed up my confusion the first time I saw it. A sniffer trace full of threes.
The first thing it reminded me of was my days with Token Ring and locally administered addresses (LAAs). This was for two reasons:
- I could only see these MAC addresses being used as destination MACs, not as source MACs. This was the same with my experience with LAAs in token ring
- The MAC addresses seemed so pretty and clean, like the Token Ring LAA typically used for a 3745 IBM front-end process — 4000.3745.0001. Just look at them. Four threes, followed by a bunch of zeros, and then just one little number.
Help from Wireshark
I hope you are familiar with Wireshark; I use it all the time. It shows “reality” on the wire, which is crucial if you are a network detective trying to solve a whodunit.
If you are familiar with Wireshark then you might know that I can configure how the MAC addresses are displayed in the columns via the Wireshark preferences. As you can see below, I have set the preferences to not resolve the MAC addresses for me, Continue reading



The digital transformation driving the adoption of multi-cloud networks requires an equivalent security transformation.
HPE, Ericsson, Nokia, and Huawei are expected to show MEC-supported use cases.
The rise of 5G and IoT devices means the threat landscape is larger than ever.