Protocol 2054?

[Carter Bullard]

Hey Jesse,
2054 is the ethernet type for arp, in decimal.
That is 0x0806.

Carter

On Apr 26, 2014, at 6:28 PM, Jesse Bowling <jessebowling at gmail.com> wrote:

> While working with argus-3.0.7.3, I noticed I have a large number of records indicating protocol "2054":
> 
>       StartTime      Flgs  Proto            SrcAddr  Sport   Dir            DstAddr  Dport  SrcPkts  DstPkts     SrcBytes     DstBytes State                 srcUdata                                             Label 
> 13:30:12.102860  e          2054        172.31.32.1          who      172.31.40.127               1        1           42           42   CON
> 13:31:00.077507  e          2054            0.0.0.0          who      172.31.40.127               2        0           84            0   INT
> 13:31:14.659504  e          2054        172.31.32.1          who      172.31.40.127               1        1           42           42   CON
> 
> 
> Is this expected?
> 
> Cheers,
> 
> Jesse
> 
> -- 
> Jesse Bowling
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 455 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20140428/8759945c/attachment.sig>