If it is following the DECnet standards, it should send out a System ID hello once per 10mins which should help you identifying the originator and its physical MAC address. Kari On 24.6.2013 21:02, Sampsa Laine wrote: I don't know, not seeing any problem per se, but something is sending stuff with a funny MAC address, aa:00:04:00:00:00, for MOP.. sampsa <sampsa at mac.com> mobile +961 788 10537 On 24 Jun 2013, at 20:50, Gregg Levine <gregg.drwho8 at gmail.com> wrote: On Mon, Jun 24, 2013 at 1:46 PM, Sampsa Laine <sampsa at mac.com> wrote: Found it, it's on my network in Finland. Wireshark says it's a DEC-MOP-Remote-Console.. Could it be the decserver? sampsa <sampsa at mac.com> mobile +961 788 10537 On 24 Jun 2013, at 18:16, Sampsa Laine <sampsa at mac.com> wrote: Hmm, That's odd, I'll have a look.. sampsa <sampsa at mac.com> mobile +961 788 10537 On 24 Jun 2013, at 18:14, Johnny Billquist <bqt at softjar.se> wrote: On 2013-06-24 17:11, Johnny Billquist wrote: On 2013-06-24 17:06, Johnny Billquist wrote: Speaking of network issues, just looking at the cache right now, I think Sampsa have something funny as well. I can see packets from him with a mac address of aa-00-04-00-00-00, which is more than a little odd... Ok. More funny stuff, while I'm at it. Sampsa seem to like to have create mac addresses in general as well, but that is ok. But the one above is maybe less well choosen. *Sigh* proofreading... I need to proofread things... "Sampsa like to have creative mac addresses..." was what I was trying to say. :-) Johnny -- Johnny Billquist || "I'm on a bus || on a psychedelic trip email: bqt at softjar.se || Reading murder books pdp is alive! || tryin' to stay hip" - B. Idol Hello! It certainly could be. After all I've got nothing working there. What is the nature of the problem? ----- Gregg C Levine gregg.drwho8 at gmail.com "This signature fought the Time Wars, time and again." .