I'm playing around with the TUN/TAP device on Linux.I've created a simple program that creates a TAP interface and prints anything that is sent through it.When I bring the interface up withip link set tap1 upsix frames are sent through it. What are these frames?I've pasted them here
What is the kernel doing when I bring a TUN/TAP interface up
linux;ip;tap
OK, I can't get the packet imported into Wireshark (there must be some headers extra or missing, not bothering to figure that out) but, this is IPv6. From your first frame, you see ff 02 00 00 00 00 00 00 00 00 00 00 00 00 00 16. That's the IPv6 address ff02::16, used for MLDv2. Edit: from your first frame, here is the IPv6 part in a format Wireshark can understand when you select File->Import and pick Encapsulation type of Raw IP or Raw IPv6 (this starts after 36 octets of other headers):0000   60 00 00 00 00 24 00 01 00 00 00 00 00 00 00 000010   00 00 00 00 00 00 00 00 ff 02 00 00 00 00 00 000020   00 00 00 00 00 00 00 16 3a 00 05 02 00 00 01 000030   8f 00 d1 ff 00 00 00 01 04 00 00 00 ff 02 00 000040   00 00 00 00 00 00 00 01 ff ea 9c a0 00 00 Edit(2): If you trim off the leading 4 octets 00 00 86 dd, then it decodes properly as an Ethernet frame.Edit(3): Here is your whole capture, with those 4 octets removed from each packet and massaged so Wireshark can import it (encapsulation Ethernet): http://pastebin.com/sUfCfPC4