When I run a packet capture from my Cisco Catalyst 8200, I am showing two addresses 192.168.1.5 and 192.168.1.6 constantly talking to each other and not in my subnet of public addresses. They have all zeroes for Mac address. I don't know what these addresses are but they are local to my switch. They mostly use port 443 with TCP and TLS1.2. I've accounted for all switch connections. It's driving me bananas that I can't locate these two addresses.
1
-
Did you look at the router ARP table for them? That would give you the MAC addresses that you could use to find the switch interfaces in the switch MAC table.– Ron Maupin ♦Commented Aug 14 at 14:51
Add a comment
|
1 Answer
An all-zero MAC address is only displayed for interfaces that don't use/require a hardware address - local loopback, serial links, tunnel endpoints or similar.
The best clue should be the interface you're capturing from.
-
I only see the addresses when i do a packet capture from the catalyst web page. If I do a packet capture with Wireshark or from the Catalyst CLI, I don't see the 192 addresses. I don't know if I'm doing these captures right or if this is inherit with the web page capture. Commented Aug 16 at 12:55
-
You need to check which interface is selected for capturing. I guess web management defaults to loopback...– Zac67 ♦Commented Aug 16 at 20:27
-
I've tried individual interfaces to the entire vlan. I have tried another Catalyst 8200 and I get the same results. Sounds like it's just part of how the packets are captured. I'm surprised I couldn't find anything saying as much from Cisco or their cadre of super techs. Commented Aug 17 at 8:26