Here is a routing puzzle:
I'm working on a poorly documented network, and I'm trying to document things as I discover them. R1 is a core L3 switch. R2 is a router. The FW is a, well, firewall.
On R1, I see traffic (about 1Mbps) in and out on vlan 19, and it's fairly constant:
R1#sh int vl 19 Vlan19 is up, line protocol is up Hardware is EtherSVI, address is 0008.e3ff.fd90 (bia 0008.e3ff.fd90) Internet address is 10.76.85.3/24 <snip> 5 minute input rate 1175000 bits/sec, 1770 packets/sec 5 minute output rate 1161000 bits/sec, 1751 packets/sec
The only devices that are in the ARP table on that subnet are R1 and R2. The FW seems not to be receiving any traffic:
R1#sh arp | i 10.76.85 Internet 10.76.85.3 - 0008.e3ff.fd90 ARPA Vlan19 Internet 10.76.85.6 13 00d7.8fcb.2400 ARPA Vlan19
However, there is no route on R1 where the next hop is R2. There is only the connected interface:
R1#sh ip ro | i 10.76.85 C 10.76.85.0/24 is directly connected, Vlan19 L 10.76.85.3/32 is directly connected, Vlan19
So how to explain the outbound traffic?
R2 also has only two devices in its ARP table:
R2#sh arp | i 10.76.85 Internet 10.76.85.3 17 0008.e3ff.fd90 ARPA TenGigabitEthernet0/0/0 Internet 10.76.85.6 - 00d7.8fcb.2400 ARPA TenGigabitEthernet0/0/0
R2 Does have a route (static) with R1 as the next hop:
R2#sh ip ro | i 10.76.85 S 10.76.81.0/24 [1/0] via 10.76.85.3 C 10.76.85.0/24 is directly connected, TenGigabitEthernet0/0/0 L 10.76.85.6/32 is directly connected, TenGigabitEthernet0/0/0
This could explain one way traffic from R2 to R1, but I see outbound traffic from R1 to ...?
These are 10G interfaces, so I can't easily plug a sniffer in. I will eventually be able to span a port and look at the traffic, but until then I'm puzzled. Anyone have any theories?