0

I found a blocked MAC address (00-1A-B6-00-64-00) in MAC access list and after disabling the MAC filtering show this detail in Wireshark :

Frame 112389: 342 bytes on wire (2736 bits), 342 bytes captured (2736 bits) on interface 0
Ethernet II, Src: TexasIns_00:64:00 (00:1a:b6:00:64:00), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 0.0.0.0, Dst: 255.255.255.255
User Datagram Protocol, Src Port: 68, Dst Port: 67
Bootstrap Protocol
    Message type: Boot Request (1)
    Hardware type: Ethernet (0x01)
    Hardware address length: 6
    Hops: 0
    Transaction ID: 0x21c6e068
    Seconds elapsed: 30831
    Bootp flags: 0x0000 (Unicast)
    Client IP address: 0.0.0.0
    Your (client) IP address: 0.0.0.0
    Next server IP address: 0.0.0.0
    Relay agent IP address: 0.0.0.0
    Client MAC address: TexasIns_00:64:00 (00:1a:b6:00:64:00)
    Client hardware address padding: 00000000000000000000
    Server host name: stellaris
    Boot file name not given
    Bootp vendor specific options: 000000000000000000000000000000000000000000000000...

I searched for TexasIns_00 and found that this device is a USB packet sniffer.

Do you think this is true?

3
  • With this information you can only tell that it might be a device that has a NIC that was made by Texas Instruments. How did you come to the conclusion it's an USB device?
    – Seth
    Jun 1, 2017 at 9:44
  • result found in google = model: TI CC2540 or CC1111 and video is youtube.com/watch?v=PXT3y9-gUCc
    – Just4Net
    Jun 3, 2017 at 3:06
  • also ti.com/lit/swru187
    – Just4Net
    Jun 3, 2017 at 3:12

1 Answer 1

0

Actually TexasIns is just Wireshark's interpretation of what's called the OUI (Organizationally Unique Identifier) which is the first three bytes of the MAC address that is unique to every manufacturer... In this case it's Texas Instruments' OUI (00:1a:b6) so there is nothing to worry about.

For more info you can refer to https://www.wireshark.org/tools/oui-lookup.html

Regards, Mo

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .