Re: oversize frame

[Andy Ruhl <acruhl%gmail.com@localhost>]

On Thu, Mar 27, 2014 at 7:06 AM, David Young <dyoung%pobox.com@localhost> wrote:
> I recognize the number, here is how I think it comes about: 6-byte
> destination MAC + 6-byte source MAC + 2-byte outer ethertype (VLAN) +
> 2-byte VLAN tag + 2-byte inner ethertype + 1500 MTU = 1518 bytes.

So a general question then: What diagnostics does NetBSD provide for
this? I assume since it's being discarded by the interface, tcpdump
would never show it? Is there a way to dump raw ethernet frames from
that interface? I'm a noob in this regard, I've only ever looked at
tcpdump or wireshark stuff.

Probably some social engineering is in order.... If this is indeed
VLAN tagging, it might not be that hard to find out who is doing it.

Andy