Broadcast and Other Reserved MAC Addresses
FF:FF:FF:FF:FF:FF is the easiest MAC address to recognise, but Ethernet reserves a whole set of addresses for specific purposes. Recognising them in a capture saves a lot of futile queries on the lookup page.
The broadcast address
All ones, FF:FF:FF:FF:FF:FF, means every device in the broadcast domain. A switch forwards it to every port in the VLAN except the ingress, while a router does not pass it to other segments, which is exactly what makes a broadcast domain boundary.
Looking at the flag bits, all ones means the I/G bit is set, so broadcast is strictly a special case of multicast. The U/L bit is set too, making it a locally administered address, which is why no vendor lookup applies.
Protocols that depend on broadcast: ARP requests, DHCP Discover and Request, NetBIOS name resolution, and assorted device discovery protocols. ARP is the most frequent of them; the mechanism is in how the ARP protocol works.
The IEEE-reserved 01:80:C2 range
This prefix is reserved by the IEEE for bridging and link-layer control protocols and represents no vendor:
| Address | Purpose |
|---|---|
01:80:C2:00:00:00 | Spanning tree BPDUs |
01:80:C2:00:00:01 | Ethernet PAUSE flow control |
01:80:C2:00:00:02 | Slow protocols, LACP and link OAM |
01:80:C2:00:00:03 | 802.1X EAPOL frames |
01:80:C2:00:00:0E | LLDP neighbour discovery |
01:80:C2:00:00:21 | GVRP / MVRP VLAN registration |
01:80:C2:00:00:03 is worth memorising on its own. It is the address used by 802.1X authentication exchanges, and frames to it are the only ones an unauthorised port will pass.
Other common reserved ranges
| Prefix | Purpose |
|---|---|
01:00:0C | Cisco proprietary protocols: CDP, VTP, PAgP |
01:1B:19 | PTP precision time protocol |
01:00:5E | IPv4 multicast mapping |
33:33 | IPv6 multicast mapping |
00:00:00:00:00:00 | All zeros, generally uninitialised or invalid |
The all-zero address should never appear as a source or destination in healthy traffic. Seeing it usually indicates a driver fault, incomplete hardware initialisation, or an unfilled field in certain DHCP messages.
The 01:00:0C prefix is genuinely registered to Cisco, but those frames are protocol control traffic rather than ordinary data. The vendor directory will confirm the registration, though it tells you little that helps with diagnosis.
Broadcast storms
Broadcast costs every device processing time. On a healthy network it should be a small share of traffic, typically a few percent at most. Once a loop forms, broadcast frames circulate endlessly and amplify, saturating links within seconds and paralysing the whole broadcast domain. That is a broadcast storm.
Main causes: spanning tree disabled or misconfigured so a loop forms, a patch cable accidentally joining two switch ports, a faulty adapter transmitting continuously, and a single broadcast domain grown too large.
How to investigate: start with interface counters and broadcast statistics:
show interfaces counters broadcast
show spanning-tree
Once you have the offending port, trace to the device using the approach in locating a device by MAC. In a capture, filter with eth.dst == ff:ff:ff:ff:ff:ff, then sort Conversations under Statistics and the noisiest source is immediately visible. Filter syntax is in filtering captures by MAC address in Wireshark.
Prevention: enable broadcast storm control on access ports with a percentage threshold, keep spanning tree running with BPDU guard on access ports, and use VLANs to keep broadcast domains to a sane size, generally no more than a few hundred devices each.