2

I was troubleshooting one of my servers when I noticed something odd. In the PCAPs I took from my server, I found non-broadcast traffic where my server was neither source or destination. The traffic is TCP conversations between other servers on the same VLAN. My server (a MacMini) is attached to a cisco 2960.

I'm suspecting a config issue on the switch, but I'm not sure what to look for... any advise would be appreciated.

Thank you!

| improve this question | |
  • 1
    Are the MACs that of your machine, broadcast, multicast? I'm not aware of a method to disable mac-learning on a 2960 (which would turn it into a "hub", flooding everything to every port.) – Ricky Beam Mar 16 '16 at 22:54
  • 1
    Can you post the config of the switch? – Ron Trunk Mar 16 '16 at 23:23
2

This sounds like something you could encounter when running a Microsoft NLB cluster somewhere in that VLAN.

Under some conditions (using unicast mode, or an improperly configured multicast mode) the switch cannot determine where the cluster MAC address lives, and then has to flood packets exchanged with the cluster on all ports.

See here for details: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/107995-configure-nlb-00.html

| improve this answer | |
  • Thank you! This seems to be what's happening to my server. – Sonic84 Apr 7 '16 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.