rogue ip address and stp traffic 1

[ellsanto]

I have a couple of issues that may or may not be related, so I am posting them together.

1. Using wireshark, I have found that i have several pcs that attempt to locate an IP address that is within my subnet, but not one of my systems. All of my systems are assigned static IPs. Occasionally when I run command arp -a on my PDC, the IP address shows on my list of connected clients. However it is listed as not having a MAC address and the IP type is "invalid" as opposed to "dynamic" like the others.

2. I have noticed an lot (a request every two seconds) of STP traffic across my network. I realize this may be nothing to be concerned about, but the source is a MAC address that I cannot locate on my network. Strange. It is not slowing the network or effecting it negatively, but if anyone can give me some insight into why this has happened, that would be great.

I have a small Server 2000 network with mostly WIN 2000 clients and a few lucky XP users.


ellsanto
-Gillan lives, have you met him?

 

[gb0mb]

The STP traffic is being generated by your switch. Spanning Tree is sending out advertisements. I always disable STP traffic but on large scale networks or networks that have many people altering configs it can be useful.

Gb0mb

........99.9% User Error........

 

[ellsanto]

Thanks for the replies. Here is what I found:

1. Quite a while back, a printer was set up with the "rogue" IP address. Turns out the printer was removed from the network, but the profile info was still in the registry. After deleting the key, I haven't seen any requests for that IP.

2. An unmanaged switch was the culprit.

Thanks again everyone for the replies.
ellsanto
-Gillan lives, have you met him?


ellsanto
-Gillan lives, have you met him?