3

I have a Cisco SG300 Small business switch, and the GUI interface is creating a lot of broadcast traffic: Source IP (The GUI IP): 172.16.xx.254:5353, Destination IP (Broadcast) 224.0.0.251:5353

I have disabled Bonjour and CDP globally on the switch.

How can I turn this traffic off? (Command line answer preferred, but GUI is also OK.)

Edit #1 - JFL's answer prompted me to make a Wireshark capture just to be 100% sure that the traffic was coming from the switch.... it is. The control GUI is broadcasting. I don't need or want that to happen.

I have no bonjour enable globally.

In the Discovery - Bonjour menu Discovery: Enable is uncheked, and the Bonjour Discovery Interface Control Table is EMPTY.

What am I missing?

Here's a sample packet:

Frame 60: 362 bytes on wire (2896 bits), 362 bytes captured (2896 bits) on interface 0
    Interface id: 0 (enp0)
    Encapsulation type: Ethernet (1)
    Arrival Time: Mar  3, 2017 16:14:17.875849274 EST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1488575657.875849274 seconds
    [Time delta from previous captured frame: 1.461698815 seconds]
    [Time delta from previous displayed frame: 4.999822643 seconds]
    [Time since reference or first frame: 43.461018609 seconds]
    Frame Number: 60
    Frame Length: 362 bytes (2896 bits)
    Capture Length: 362 bytes (2896 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:udp:mdns]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: 00:9e:1e:xx:xx:x1 (00:9e:1e:xx:xx:x1), Dst: IPv4mcast_fb (01:00:5e:yy:yy:yb)
    Destination: IPv4mcast_fb (01:00:5e:yy:yy:yb)
        Address: IPv4mcast_fb (01:00:5e:yy:yy:yb)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
    Source: 00:9e:1e:xx:xx:x1 (00:9e:1e:xx:xx:x1)
        Address: 00:9e:1e:xx:xx:x1 (00:9e:1e:xx:xx:x1)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 172.16.xx.254, Dst: 224.0.0.251
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes
    Differentiated Services Field: 0xe0 (DSCP: CS7, ECN: Not-ECT)
        1110 00.. = Differentiated Services Codepoint: Class Selector 7 (56)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 348
    Identification: 0x2e4f (11855)
    Flags: 0x00
        0... .... = Reserved bit: Not set
        .0.. .... = Don't fragment: Not set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 1
        [Expert Info (Note/Sequence): "Time To Live" != 255 for a packet sent to the Local Network Control Block (see RFC 3171)]
            ["Time To Live" != 255 for a packet sent to the Local Network Control Block (see RFC 3171)]
            [Severity level: Note]
            [Group: Sequence]
    Protocol: UDP (17)
    Header checksum: 0xca52 [validation disabled]
        [Good: False]
        [Bad: False]
    Source: 172.16.xx.254
    Destination: 224.0.0.251
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: 5353 (5353), Dst Port: 5353 (5353)
    Source Port: 5353
    Destination Port: 5353
    Length: 328
    Checksum: 0x6346 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    [Stream index: 0]
Multicast Domain Name System (response)
    Transaction ID: 0x0000
    Flags: 0x8000 Standard query response, No error
        1... .... .... .... = Response: Message is a response
        .000 0... .... .... = Opcode: Standard query (0)
        .... .0.. .... .... = Authoritative: Server is not an authority for domain
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...0 .... .... = Recursion desired: Don't do query recursively
        .... .... 0... .... = Recursion available: Server can't do recursive queries
        .... .... .0.. .... = Z: reserved (0)
        .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
        .... .... ...0 .... = Non-authenticated data: Unacceptable
        .... .... .... 0000 = Reply code: No error (0)
    Questions: 0
    Answer RRs: 1
    Authority RRs: 0
    Additional RRs: 0
    Answers
        VSDPb45501._csco-sb-vsdp._mdns._udp.local: type TXT, class IN
            Name: VSDPb45501._csco-sb-vsdp._mdns._udp.local
            Type: TXT (Text strings) (16)
            .000 0000 0000 0001 = Class: IN (0x0001)
            0... .... .... .... = Cache flush: False
            Time to live: 25
            Data length: 255
            TXT Length: 6
            TXT: type=0
            TXT Length: 9
            TXT: version=1
            TXT Length: 21
            TXT: refresh-age-timeout=0
            TXT Length: 10
            TXT: priority=0
            TXT Length: 14
            TXT: refresh-flag=0
            TXT Length: 34
            TXT: root-mac-address=00:9e:1e:xx:xx:x1
            TXT Length: 6
            TXT: cost=0
            TXT Length: 26
            TXT: transm-address=172.16.xx.254
            TXT Length: 23
            TXT: transm-interface=100049
            TXT Length: 16
            TXT: voice-vlan-id=10
            TXT Length: 16
            TXT: voice-vlan-vpt=5
            TXT Length: 18
            TXT: voice-vlan-dscp=46
            TXT Length: 43
            TXT: md5-auth=01af9cba5ed0218b0848195834e6a878ae

Edit #2

I found the following by rooting around on the console. Don't know if this gives anybody any ideas, but the documentation doesn't say anything useful.

show bonjour 
Bonjour global status: disabled
Bonjour L2 interfaces port list: none

Service   Admin Status   Oper Status
-------   ------------   -----------
csco-sb   enabled        enabled 
http      enabled        enabled 
https     enabled        enabled 
ssh       enabled        enabled 
telnet    enabled        disabled
Improve this question
7
  • first thing i have thought t\ if you have any Apple product connected to network, disconnet it
    – noissue
    Mar 3, 2017 at 20:55
  • There are NO apple products on the network. At the moment just a linux box... still testing and setting up firewall/snort etc, so I don't have very much running. The adddress generating the traffic is an address created by the SG300 for it's Control Web GUI. The answer has to be a change to the switch configuration.
    – user73383
    Mar 3, 2017 at 21:05
  • seems that the packet is a mDNS response to a query for "VSDPb45501._csco-sb-vsdp._mdns._udp.local". Does the capture show anithing related? could be a bug in the switch software. Do you run the latest version?
    – JFL
    Mar 3, 2017 at 21:51
  • @JFL I'll double check, but I upgraded the firmware when I bought the switch about 2 months ago... so I'm pretty sure it's the latest. What should I be looking for? Any hints/suggestions? Is there some sort of DNS configuration that I need to turn off?
    – user73383
    Mar 3, 2017 at 22:08
  • According to the manual, Bonjour is enabled by default on the management VLAN. You must specifically disable it for the management VLAN. It sounds like you are using the management VLAN for access devices. If you are using the switch in layer-2 mode, you cannot enable/disable on a per interface or VLAN basis, and you must select Disable and Apply globally.
    – Ron Maupin ♦
    Mar 3, 2017 at 23:40

4 Answers 4

Reset to default
1

224.0.0.251 is the multicast (and not broadcast) address used by the apple Bonjour protocol but also by the associated multicast DNS (rfc6762)

So there's two cause of traffic sent to this multicast address:

  • bonjour advertisements
  • resolution of .local DNS names

So I would first double check that bonjour advertisement are disabled (in Administration > Discovery - Bonjour.) but also check that there's no DNS name ending with .local anywhere.

Analysing the frame sent (with wireshark / tcdump / MS message analyser) could also determine if they are actually bonjour discovery message

If it's actually bonjour discovery packet and it's really off then I'll upgrade the switch with the latest software and see if it persists, then submit the issue to Cisco.

Improve this answer
3
  • How would I disable resolution of .local DNS names on the switch.
    – user73383
    Mar 3, 2017 at 21:09
  • Didn't found anything about this in the switch documentation. The point is to ensure for example the the switch is not configured with "switch1.local" dns name for example.
    – JFL
    Mar 3, 2017 at 21:12
  • Where would I look to ensure the the switch is not configured with "switch1.local" dns name?
    – user73383
    Mar 3, 2017 at 21:45
1

Unfortunately it appears to be a bug in Cisco IOS:

https://quickview.cloudapps.cisco.com/quickview/bug/CSCum51028

Improve this answer
2
  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer. By the way, the SG300 doesn't run IOS.
    – Ron Maupin ♦
    Apr 18, 2017 at 17:16
  • see below; "voice vlan state disabled" worked around this bug on my SG350X today (2021-07-11).
    – Paul Vixie
    Jul 11, 2021 at 16:57
0

This is a VSDP packet. Cisco's horrible and proprietary way for their small business lines of switches to communicate the agreed upon voice vlan around the network. It's a pain, will add/remove vlans, mess with your trunk port configuration, and doesn't seem to be able to be disabled. You can probably build an ACL and apply it to each port, though.

VSDP Patent Request: http://www.freepatentsonline.com/y2013/0259027.html

Improve this answer
0

The voice vlan state disabled configuration command will stop these broadcasts.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.