[cisco-voip] Port keeps going err-disabled

[David Zhars]

Yes, was def something on his PC.  Some IE Toolbar and a special folder
with a little batch file in it that was something like

copy /y thisjunk.exe iexplore.exe

So sort of replace IE with this infected mess.

I have never seen a PC shoot out BPDU packets before!  Learn something new
every day!

Thanks.


On Fri, Mar 29, 2013 at 6:53 AM, Joshua Morgan <joshua.morgan at gmail.com>wrote:

> SPAN the switch interface and see what is sourcing the BPDUs?
>
> Sent from my iPhone
>
> On 29/03/2013, at 11:28, David Zhars <dzhars at gmail.com> wrote:
>
> > hey all.
> >
> > have 3560's with a bunch of 7941s and PCs hanging off the phones.  All
> ports configured the same (portfast, bpduguard, etc).
> >
> > I have this one guy that at least once a day, his port shuts off, goes
> into err-disable.  Sometimes it's in that state when he comes in in the
> morning, other times it will be that way when he comes back from lunch.  It
> does not seem to happen when he is working on his PC.
> >
> > Happened again today, so I went in the 3560, did a "shut" followed by
> "no shut".  The port went connected and a few seconds later, right back to
> err-disable.  I did it several times, and each time, immediately the port
> went back to err-disable.  I finally drove over there, and with just the
> phone, the port stayed up.  plug in the PC, and the port will err-disable.
>  I removed some junk ware from his PC and cranked up the AV and Spyware
> protection, will see what happens.
> >
> > Do you think it might be the phone's bridge?  Flaky switch port
> (doubtful today I moved him to a new port and again, it immed went to
> err-dis).  When I do the "show err-dis reason" (I know it's not reason, I
> forget the syntax), the reason listed is "bpduguard".  How the heck do I
> trip a bpduguard with just a phone and PC?  have swapped out the cables
> too....
> >
> > Just looking for some insight!  Next will be a new NIC card and running
> a new cable from the data room to his office.
> > _______________________________________________
> > cisco-voip mailing list
> > cisco-voip at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-voip
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20130329/3d35b8d4/attachment.html>