Whoops, mixed this up with ISL. This is ISL group 0. sorry for the spewage.. chris

I think these maybe the Cisco LOOP pulses sent out to detect link status. Lemme check in the lab...

chris

...

-----Original Message----- From: Simon Leinen [mailto:simon@limmat.switch.ch] Sent: Friday, June 01, 2001 8:47 AM To: Alex Rubenstein Cc: nanog@merit.edu Subject: Re: mac-address accounting

...

...

...

...

> "ar" == Alex Rubenstein <alex@nac.net> writes: core1.nyc#sho int g0/0/0 mac-accounting GigabitEthernet0/0/0 to external peers and customers Output (475 free) [...] 0100.0c00.0000(13 ): 57198 packets, 37155973 bytes, last: 388ms ago [...] core1.nyc#sho arp | inc 0100 core1.nyc#

01:00:0c is Cisco's Ethernet multicast address prefix. 01:00:0c:00:00:00 looks strange to me.

The cisco-nsp mailing list had a query about this problem:

http://puck.nether.net/lists/cisco-nsp/0318.html

But I don't know whether this has been resolved. If I try outbound MAC accounting (usually I only use inbound MAC accounting at exchange points) on a 7206VXR running 12.0(17)S, everything looks fine.

...

All the others are valid, yet they are way, and I mean *way* under the amounts that I know I am sending to that peer.

(Maybe your Cisco multicasts all traffic out to the exchange point rather than send it to the correct peer - seems much more robust to me, although you might end up with heavy packet replication :-) -- Simon Leinen simon@babar.switch.ch SWITCH http://www.switch.ch/misc/leinen/

Computers hate being anthropomorphized.