1#
2# Well-known addresses.
3#
4# Wireshark - Network traffic analyzer
5# By Gerald Combs <gerald [AT] wireshark.org>
6# Copyright 1998 Gerald Combs
7#
8# SPDX-License-Identifier: GPL-2.0-or-later
9#
10# The data below has been assembled from the following sources:
11#
12# Michael Patton's "Ethernet Codes Master Page" available from:
13# <http://www.cavebear.com/CaveBear/Ethernet/>
14# <ftp://ftp.cavebear.com/pub/Ethernet.txt>
15#
16# Microsoft Windows 2000 Server
17# Operating System
18# Network Load Balancing Technical Overview
19# White Paper
20#
2100-00-00-00-FE-21	Checkpoint-Uninitialized-Cluster-Member
2200-00-0C-07-AC/40	All-HSRP-routers
2300-00-5E-00-01/40	IETF-VRRP-VRID
2400-0C-0C-0C-0C-0C	Cisco-ACI-Gleaning-Leaf
2500-0D-0D-0D-0D-0D	Cisco-ACI-Gleaning-Spine
2600-BF-00-00-00-00/16	MS-NLB-VirtServer
2700-E0-2B-00-00-00	Extreme-EDP
28# Extreme Encapsulation Protocol (basically EDP renamed)
2900-E0-2B-00-00-01	Extreme-EEP
3000-E0-2B-00-00-02	Extreme-ESRP-Client
3100-E0-2B-00-00-04	Extreme-EAPS
3200-E0-2B-00-00-06	Extreme-EAPS-SL
3300-E0-2B-00-00-08	Extreme-ESRP-Master
3401-00-0C-00-00/40	ISL-Frame
3501-00-0C-CC-CC-CC	CDP/VTP/DTP/PAgP/UDLD
3601-00-0C-CC-CC-CD	PVST+
3701-00-0C-CD-CD-CD	STP-UplinkFast
3801-00-0C-CD-CD-CE	VLAN-bridge
3901-00-0C-CD-CD-D0	GBPT
4001-00-0C-DD-DD-DD	CGMP
4101-00-10-00-00-20	Hughes-Lan-Systems-Terminal-Server-S/W-download
4201-00-10-FF-FF-20	Hughes-Lan-Systems-Terminal-Server-S/W-request
4301-00-1D-00-00-00	Cabletron-PC-OV-PC-discover-(on-demand)
4401-00-1D-00-00-05	Cabletron-PVST-BPDU
4501-00-1D-00-00-06	Cabletron-QCSTP-BPDU
4601-00-1D-42-00-00	Cabletron-PC-OV-Bridge-discover-(on-demand)
4701-00-1D-52-00-00	Cabletron-PC-OV-MMAC-discover-(on-demand)
4801-00-3C		Auspex-Systems-(Serverguard)
4901-00-5E/25		IPv4mcast
5001-00-81-00-00-00	Nortel-Network-Management
5101-00-81-00-00-02	Nortel-Network-Management
5201-00-81-00-01-00	Nortel-autodiscovery
5301-00-81-00-01-01	Nortel-autodiscovery
54# Cisco Fabric Path
5501-0F-FF-C1-01-C0	FP-Flood-to-all-VLANs
5601-0F-FF-C1-02-C0	FP-Flood-to-all-Fabrics
57#
58# As per
59#
60#	http://www.t11.org/ftp/t11/pub/fc/bb-5/08-334v0.pdf
61#
62# Broadcom "donated" one of their OUIs, 00-10-18, for use for
63# Fibre Channel over Ethernet, so we add entries for the
64# addresses in that document and a group of addresses for all
65# otherwise unlisted 01-10-18-XX-XX-XX addresses.
66#
6701-10-18-01-00-00	All-FCoE-MACs
6801-10-18-01-00-01	All-ENode-MACs
6901-10-18-01-00-02	All-FCF-MACs
7001-10-18-00-00-00/24	FCoE-group
7101-11-1E-00-00-01	EPLv2_SoC
7201-11-1E-00-00-02	EPLv2_PRes
7301-11-1E-00-00-03	EPLv2_SoA
7401-11-1E-00-00-04	EPLv2_ASnd
7501-11-1E-00-00-05	EPLv2_AMNI
7601-20-25/25		Control-Technology-Inc's-Industrial-Ctrl-Proto.
7701-80-24-00-00-00	Kalpana-Etherswitch-every-60-seconds
78# IEEE 802.1Q-2018 Table 8-1, C-VLAN and MAC Bridge component Reserved addresses
7901-80-C2-00-00-00/44	Spanning-tree-(for-bridges)
80# 01-80-C2-00-00-00	also: Nearest customer bridge
8101-80-C2-00-00-01	MAC-specific-ctrl-proto-01
8201-80-C2-00-00-02	Slow-Protocols
8301-80-C2-00-00-03	Nearest-non-TPMR-bridge
8401-80-C2-00-00-04	MAC-specific-ctrl-proto-04
8501-80-C2-00-00-05	Reserved-future-std-05
8601-80-C2-00-00-06	Reserved-future-std-06
8701-80-C2-00-00-07	MEF-Forum-ELMI-proto
8801-80-C2-00-00-08	Provider-Bridge
8901-80-C2-00-00-09	Reserved-future-std-09
9001-80-C2-00-00-0A	Reserved-future-std-0a
9101-80-C2-00-00-0B	EDE-SS-PEP
9201-80-C2-00-00-0C	Reserved-future-std-0c
9301-80-C2-00-00-0D	Provider-Bridge-MVRP
9401-80-C2-00-00-0E	LLDP_Multicast
9501-80-C2-00-00-0F	Reserved-future-std-0f
9601-80-C2-00-00-10	Bridge-Management
9701-80-C2-00-00-11	Load-Server
9801-80-C2-00-00-12	Loadable-Device
9901-80-C2-00-00-13	IEEE-1905.1-Control
10001-80-C2-00-00-14	ISIS-all-level-1-IS's
10101-80-C2-00-00-15	ISIS-all-level-2-IS's
10201-80-C2-00-00-18	IEEE-802.1B-All-Manager-Stations
10301-80-C2-00-00-19	IEEE-802.11aa-groupcast-with-retries
10401-80-C2-00-00-1A	IEEE-802.1B-All-Agent-Stations
10501-80-C2-00-00-1B	ESIS-all-multicast-capable-ES's
10601-80-C2-00-00-1C	ESIS-all-multicast-announcements
10701-80-C2-00-00-1D	ESIS-all-multicast-capable-IS's
10801-80-C2-00-00-1E	Token-Ring-all-DTR-Concentrators
10901-80-C2-00-00-30/45	OAM-Multicast-DA-Class-1
11001-80-C2-00-00-38/45	OAM-Multicast-DA-Class-2
11101-80-C2-00-00-40	All-RBridges
11201-80-C2-00-00-41	All-IS-IS-RBridges
11301-80-C2-00-00-42	All-Egress-RBridges
11401-80-C2-00-00-45	TRILL-End-Stations
11501-80-C2-00-00-46	All-Edge-RBridges
11601-80-C2-00-01-00	FDDI-RMT-Directed-Beacon
11701-80-C2-00-01-10	FDDI-status-report-frame
11801-DD-00-FF-FF-FF	Ungermann-Bass-boot-me-requests
11901-DD-01-00-00-00	Ungermann-Bass-Spanning-Tree
12001-E0-52-CC-CC-CC	Foundry-DP
121# DOCSIS, defined in ANSI SCTE 22-1 2012
12201-E0-2F-00-00-01	DOCSIS-CM
12301-E0-2F-00-00-02	DOCSIS-CMTS
12401-E0-2F-00-00-03	DOCSIS-STP
125
126# Extremenetworks in their infinite wisdom seems to use 02-04-94 (Vendor MAC XOR 02-00-00)
127# for their base mac address, thus colliding with MS-NLB 02-04/16 which Microsoft in their
128# infinite wisdom decided to use for MS-NLB.
12902-04-96-00-00-00/24	ExtremeNetworks
130
131# Microsoft Network Load Balancing (NLB)
132# Actually, 02-01-virtualip to 02-20-virtualip will be used from server to rest-of-world
133# 02-bf-virtualip will be used from rest-of-world to server
13402-BF-00-00-00-00/16	MS-NLB-VirtServer
13502-01-00-00-00-00/16	MS-NLB-PhysServer-01
13602-02-00-00-00-00/16	MS-NLB-PhysServer-02
13702-03-00-00-00-00/16	MS-NLB-PhysServer-03
13802-04-00-00-00-00/16	MS-NLB-PhysServer-04
13902-05-00-00-00-00/16	MS-NLB-PhysServer-05
14002-06-00-00-00-00/16	MS-NLB-PhysServer-06
14102-07-00-00-00-00/16	MS-NLB-PhysServer-07
14202-08-00-00-00-00/16	MS-NLB-PhysServer-08
14302-09-00-00-00-00/16	MS-NLB-PhysServer-09
14402-0a-00-00-00-00/16	MS-NLB-PhysServer-10
14502-0b-00-00-00-00/16	MS-NLB-PhysServer-11
14602-0c-00-00-00-00/16	MS-NLB-PhysServer-12
14702-0d-00-00-00-00/16	MS-NLB-PhysServer-13
14802-0e-00-00-00-00/16	MS-NLB-PhysServer-14
14902-0f-00-00-00-00/16	MS-NLB-PhysServer-15
15002-10-00-00-00-00/16	MS-NLB-PhysServer-16
15102-11-00-00-00-00/16	MS-NLB-PhysServer-17
15202-12-00-00-00-00/16	MS-NLB-PhysServer-18
15302-13-00-00-00-00/16	MS-NLB-PhysServer-19
15402-14-00-00-00-00/16	MS-NLB-PhysServer-20
15502-15-00-00-00-00/16	MS-NLB-PhysServer-21
15602-16-00-00-00-00/16	MS-NLB-PhysServer-22
15702-17-00-00-00-00/16	MS-NLB-PhysServer-23
15802-18-00-00-00-00/16	MS-NLB-PhysServer-24
15902-19-00-00-00-00/16	MS-NLB-PhysServer-25
16002-1a-00-00-00-00/16	MS-NLB-PhysServer-26
16102-1b-00-00-00-00/16	MS-NLB-PhysServer-27
16202-1c-00-00-00-00/16	MS-NLB-PhysServer-28
16302-1d-00-00-00-00/16	MS-NLB-PhysServer-29
16402-1e-00-00-00-00/16	MS-NLB-PhysServer-30
16502-1f-00-00-00-00/16	MS-NLB-PhysServer-31
16602-20-00-00-00-00/16	MS-NLB-PhysServer-32
167
168#       [ The following block of addresses (03-...) are used by various ]
169#       [ standards.  Some (marked [TR?]) are suspected of only being   ]
170#       [ used on Token Ring for group addresses of Token Ring specific ]
171#       [ functions, reference ISO 8802-5:1995 aka. IEEE 802.5:1995 for ]
172#       [ some info.  These in the Ethernet order for this list.  On    ]
173#       [ Token Ring they appear reversed.  They should never appear on ]
174#       [ Ethernet.  Others, not so marked, are normal reports (may be  ]
175#       [ seen on either).
17603-00-00-00-00-01	NETBIOS-# [TR?]
17703-00-00-00-00-02	Locate-Directory-Server # [TR?]
17803-00-00-00-00-04	Synchronous-Bandwidth-Manager-# [TR?]
17903-00-00-00-00-08	Configuration-Report-Server-# [TR?]
18003-00-00-00-00-10	Ring-Error-Monitor-# [TR?]
18103-00-00-00-00-10	(OS/2-1.3-EE+Communications-Manager)
18203-00-00-00-00-20	Network-Server-Heartbeat-# [TR?]
18303-00-00-00-00-40	(OS/2-1.3-EE+Communications-Manager)
18403-00-00-00-00-80	Active-Monitor # [TR?]
18503-00-00-00-01-00	OSI-All-IS-Token-Ring-Multicast
18603-00-00-00-02-00	OSI-All-ES-Token-Ring-Multicast
18703-00-00-00-04-00	LAN-Manager # [TR?]
18803-00-00-00-08-00	Ring-Wiring-Concentrator # [TR?]
18903-00-00-00-10-00	LAN-Gateway # [TR?]
19003-00-00-00-20-00	Ring-Authorization-Server # [TR?]
19103-00-00-00-40-00	IMPL-Server # [TR?]
19203-00-00-00-80-00	Bridge # [TR?]
19303-00-00-20-00-00	IP-Token-Ring-Multicast (RFC1469)
19403-00-00-80-00-00	Discovery-Client
19503-00-0C-00-00/40	ISL-Frame [TR?]
19603-00-C7-00-00-EE	HP (Compaq) ProLiant NIC teaming
19703-00-FF-FF-FF-FF	All-Stations-Address
19803-BF-00-00-00-00/16	MS-NLB-VirtServer-Multicast
19909-00-07-00-00-00/40	AppleTalk-Zone-multicast-addresses
200			# only goes through 09-00-07-00-00-FC?
20109-00-07-FF-FF-FF	AppleTalk-broadcast-address
20209-00-09-00-00-01	HP-Probe
20309-00-09-00-00-04	HP-DTC
20409-00-0D-00-00-00/24	ICL-Oslan-Multicast
20509-00-0D-02-00-00	ICL-Oslan-Service-discover-only-on-boot
20609-00-0D-02-0A-38	ICL-Oslan-Service-discover-only-on-boot
20709-00-0D-02-0A-39	ICL-Oslan-Service-discover-only-on-boot
20809-00-0D-02-0A-3C	ICL-Oslan-Service-discover-only-on-boot
20909-00-0D-02-FF-FF	ICL-Oslan-Service-discover-only-on-boot
21009-00-0D-09-00-00	ICL-Oslan-Service-discover-as-required
21109-00-1E-00-00-00	Apollo-DOMAIN
21209-00-2B-00-00-00	DEC-MUMPS?
21309-00-2B-00-00-01	DEC-DSM/DDP
21409-00-2B-00-00-02	DEC-VAXELN?
21509-00-2B-00-00-03	DEC-Lanbridge-Traffic-Monitor-(LTM)
21609-00-2B-00-00-04	DEC-MAP-(or-OSI?)-End-System-Hello?
21709-00-2B-00-00-05	DEC-MAP-(or-OSI?)-Intermediate-System-Hello?
21809-00-2B-00-00-06	DEC-CSMA/CD-Encryption?
21909-00-2B-00-00-07	DEC-NetBios-Emulator?
22009-00-2B-00-00-0F	DEC-Local-Area-Transport-(LAT)
22109-00-2B-00-00-10/44	DEC-Experimental
22209-00-2B-01-00-00	DEC-LanBridge-Copy-packets-(All-bridges)
22309-00-2B-01-00-01	DEC-LanBridge-Hello-packets-(All-local-bridges)
22409-00-2B-02-00-00	DEC-DNA-Level-2-Routing-Layer-routers?
22509-00-2B-02-01-00	DEC-DNA-Naming-Service-Advertisement?
22609-00-2B-02-01-01	DEC-DNA-Naming-Service-Solicitation?
22709-00-2B-02-01-09	DEC-Availability-Manager-for-Distributed-Systems-DECamds
22809-00-2B-02-01-02	DEC-Distributed-Time-Service
22909-00-2B-03-00-00/32	DEC-default-filtering-by-bridges?
23009-00-2B-04-00-00	DEC-Local-Area-System-Transport-(LAST)?
23109-00-2B-23-00-00	DEC-Argonaut-Console?
23209-00-4C-00-00-00	BICC-802.1-management
23309-00-4C-00-00-02	BICC-802.1-management
23409-00-4C-00-00-06	BICC-Local-bridge-STA-802.1(D)-Rev6
23509-00-4C-00-00-0C	BICC-Remote-bridge-STA-802.1(D)-Rev8
23609-00-4C-00-00-0F	BICC-Remote-bridge-ADAPTIVE-ROUTING
23709-00-56-FF-00-00/32	Stanford-V-Kernel,-version-6.0
23809-00-6A-00-01-00	TOP-NetBIOS.
23909-00-77-00-00-00	Retix-Bridge-Local-Management-System
24009-00-77-00-00-01	Retix-spanning-tree-bridges
24109-00-77-00-00-02	Retix-Bridge-Adaptive-routing
24209-00-7C-01-00-01	Vitalink-DLS-Multicast
24309-00-7C-01-00-03	Vitalink-DLS-Inlink
24409-00-7C-01-00-04	Vitalink-DLS-and-non-DLS-Multicast
24509-00-7C-02-00-05	Vitalink-diagnostics
24609-00-7C-05-00-01	Vitalink-gateway?
24709-00-7C-05-00-02	Vitalink-Network-Validation-Message
24809-00-87-80-FF-FF	Xyplex-Terminal-Servers
24909-00-87-90-FF-FF	Xyplex-Terminal-Servers
2500C-00-0C-00-00/40	ISL-Frame
2510D-1E-15-BA-DD-06	HP
25220-52-45-43-56-00/40	Receive
25320-53-45-4E-44-00/40	Send
25433-33-00-00-00-00	IPv6-Neighbor-Discovery
25533-33-00-00-00-00/16	IPv6mcast
256AA-00-03-00-00-00/32	DEC-UNA
257AA-00-03-01-00-00/32	DEC-PROM-AA
258AA-00-03-03-00-00/32	DEC-NI20
259AB-00-00-01-00-00	DEC-MOP-Dump/Load-Assistance
260AB-00-00-02-00-00	DEC-MOP-Remote-Console
261AB-00-00-03-00-00	DECNET-Phase-IV-end-node-Hello-packets
262AB-00-00-04-00-00	DECNET-Phase-IV-Router-Hello-packets
263AB-00-03-00-00-00	DEC-Local-Area-Transport-(LAT)-old
264AB-00-04-01-00-00/32	DEC-Local-Area-VAX-Cluster-groups-SCA
265CF-00-00-00-00-00	Ethernet-Configuration-Test-protocol-(Loopback)
266FF-FF-00-60-00-04	Lantastic
267FF-FF-00-40-00-01	Lantastic
268FF-FF-01-E0-00-04	Lantastic
269
270FF-FF-FF-FF-FF-FF	Broadcast
271