Re: [nsp] Weird behaviour of Cat4000

From: Jan-Ahrent Czmok (czmok@gatel.net)
Date: Mon Apr 22 2002 - 15:24:31 EDT


On Mon, 22 Apr 2002 20:01:53 +0100
"Ryan O'Connell" <ryan-nsp@complicity.co.uk> wrote:

> On Mon, Apr 22, 2002 at 08:46:16PM +0200, Jan-Ahrent Czmok wrote:
> > connected a sniffer on one port (housing) and i can see traffic from the other customers of ours.
> > Normally i should only see my traffic (no i am not talking about broadcast or multicast).
>
> Is this traffic to an "unknown" destination - I.e. one that may not have sent
> out any packets? I've seen this with some broken NIC failover/Server failover
> systems - the device replies to ARPs with a "shared" MAC address but is sending
> out packets with the Burnt-in MAC address on the card. The switch doesn't know
> where to send the traffic so it just floods it to all ports.
>

Good question. Looks like regular traffic to me (POP3/http/SYN/ACK stuff).
the cat behaves like a big HUB :-(

but the strange is: it's not all traffic passing over the switch, just sub-portions of the complete traffic.

mac-address-table is not overloaded or similar stuff, so i am really a bit curious where the error comes from.
i would assume something broken with stp or bridging modes (or port channel stuff.)

We would like to use the switch just as a normal "housing aggregation switch"

--jan

> --
> Ryan O'Connell - CCIE #8174
> <ryan@complicity.co.uk> - http://www.complicity.co.uk
>
>
> I'm not losing my mind, no I'm not changing my lines,
> I'm just learning new things with the passage of time
>



This archive was generated by hypermail 2b29 : Sun Aug 04 2002 - 04:13:12 EDT