After Arp issues we upgraded 8600 to ver 5.1 & now OK , BUT !!!!

[mucca]

Hello All after the above upgrade our "corrupt arp" issues disapeared however it seems as though now the DHCP/DNS servers have databese corruptions with "bad address" and name resolutions to the wrong ip ?
The passports arp table will see 2 ip addresses with one to the correct mac and the other to mac 00:11:22:33:44:55: we have a number of devices with these same strange mac addresses ?
Any ideas guys ?
Any help much appreciated,
Big thanks
Mucka

 

[andy88]

What are the devices that have dual MAC addresses? If you do a "ipconfig /all" or equvilent command do you see the MAC address.

You could try running a sniffer or the built in PCAP engine on one of the ports with the issue to see if the MAC is coming into the switch or if the switch is generating it itself.

 

[mucca]

Thanks Andy88 , we found that these spurious macs were being generated from a particular port that fed a hub with various devices into it .This was used by our "Internet Security" guy who says it is necessary for his research ??
So as a work around we give him his own Vlan/subnet as the problem only occurred within the vlan.
How do you use the PCAP engine ? not something I am familiar with.
Thanks for your help

Mucca

 

[andy88]

To run PCAP

On device manager
Enable globally on the PCAP tab under Diagnostics menu.

Enable PCAP on the port under the edit port settings. You can also define a filter if you want to only capture certain traffic.

Disable PCAP on port once capture is done.

The capture is stored on the standby CPU. Telnet onto the standby.

Copy the capture from memory to the PCMCIA file
# copy PCAP00 /pcmcia/<filename>

Then the file can be copied off and opened with any sniffer software.

 

[mucca]

Big Thanks Andy88 , will try this
Mucca

 

[YamaDave]

FYI - I didn't see it mentioned but PCAP won't workj if you are setup in HA last time I checked..