An ISP came and set up their radios the other day. After connecting my router to the radio and configuring it with the IP address, netmask, and gateway which they specified, I can't ping their gateway (it doesn't even answer ARP queries).
However, doing a packet trace on the radio's Ethernet port, I can see a constant stream of frames with EtherType 9C9D. They are directed to 2 specific MAC addresses, and it seems that something is sending them once per second.
Here is an excerpt from tcpdump:
11:57:58.401652 00:15:67:64:f5:55 (oui Unknown) > 00:00:07:d6:c4:f3 (oui Unknown), ethertype Unknown (0x9c9d), length 62:
0x0000: 8d00 1000 8b00 1065 8d00 1000 0000 002a .......e.......*
0x0010: 0260 d742 0000 0000 0000 0000 0000 0000 .`.B............
0x0020: 0000 0007 0000 0015 6764 f555 0103 f2f2 ........gd.U....
11:57:58.901660 00:15:67:64:f5:55 (oui Unknown) > 00:15:67:00:00:02 (oui Unknown), ethertype Unknown (0x9c9d), length 62:
0x0000: 8d00 1000 8b00 1065 8d00 1000 0000 002a .......e.......*
0x0010: 0260 d746 0000 0000 0000 0000 0000 0000 .`.F............
0x0020: 0000 0007 0000 0015 6764 f555 0103 f2ee ........gd.U....
Google is failing me here. Does anyone know what those frames are???
Best Answer
Those look like some sort of topology discovery mechanism (like cdp or lldp.)
(It's as if it's searching for an NMS or link-partner to know how to configure itself. But I'm not familiar with how Radwin's gear works. I would hope your ISP has any required documentation and experience with this stuff.)