Ethernet: DDP Client With DDP Type=69 ID



While checking Ethernet traffic, we noticed a large number of short
(60-byte) EtherTalk packets (Phase 1) of an unknown protocol type. We
opened the packet and found that they were DDP Type=69. The Ethernet is
heavily loaded, especially with LAVC (Local Area VAX Cluster) traffic, and
the apparently exclusive use of minimum size packets is a concern.

Can you identify the application that uses/produces these packets? We use
3COM servers and the older 3+Share Macintosh client software.

There is no way to tell which vendor creates packets with DDP Type=69
because Apple does not assign or control the use of DDP Type beyond $0F.

We don't know if the packets come from the 3COM server, but you could try to
find the Ethernet node by matching the 48-bit Ethernet source address in the
802.3 header and the Ethernet adapter hardware address.


Published Date: Feb 18, 2012