5

Here is a routing puzzle:

I'm working on a poorly documented network, and I'm trying to document things as I discover them. R1 is a core L3 switch. R2 is a router. The FW is a, well, firewall.

enter image description here

On R1, I see traffic (about 1Mbps) in and out on vlan 19, and it's fairly constant:

R1#sh int vl 19
Vlan19 is up, line protocol is up
  Hardware is EtherSVI, address is 0008.e3ff.fd90 (bia 0008.e3ff.fd90)
  Internet address is 10.76.85.3/24
<snip>
  5 minute input rate 1175000 bits/sec, 1770 packets/sec
  5 minute output rate 1161000 bits/sec, 1751 packets/sec

The only devices that are in the ARP table on that subnet are R1 and R2. The FW seems not to be receiving any traffic:

R1#sh arp | i 10.76.85
Internet  10.76.85.3              -   0008.e3ff.fd90  ARPA   Vlan19
Internet  10.76.85.6             13   00d7.8fcb.2400  ARPA   Vlan19

However, there is no route on R1 where the next hop is R2. There is only the connected interface:

R1#sh ip ro | i 10.76.85
C        10.76.85.0/24 is directly connected, Vlan19
L        10.76.85.3/32 is directly connected, Vlan19

So how to explain the outbound traffic?

R2 also has only two devices in its ARP table:

R2#sh arp | i 10.76.85
Internet  10.76.85.3             17   0008.e3ff.fd90  ARPA   TenGigabitEthernet0/0/0
Internet  10.76.85.6              -   00d7.8fcb.2400  ARPA   TenGigabitEthernet0/0/0

R2 Does have a route (static) with R1 as the next hop:

R2#sh ip ro | i 10.76.85
S        10.76.81.0/24 [1/0] via 10.76.85.3
C        10.76.85.0/24 is directly connected, TenGigabitEthernet0/0/0
L        10.76.85.6/32 is directly connected, TenGigabitEthernet0/0/0

This could explain one way traffic from R2 to R1, but I see outbound traffic from R1 to ...?

These are 10G interfaces, so I can't easily plug a sniffer in. I will eventually be able to span a port and look at the traffic, but until then I'm puzzled. Anyone have any theories?

|improve this question
  • Have you tried an ARP sweep to see if something else is there and just not actively in the ARP table? Basically, just ping the entire subnet with a single packet to each host IP and set a low timeout, and then show the ARP table at the end, to see if anything doesn't say Incomplete. – Jesse P. Feb 15 '19 at 17:57
  • 2
    Is the destination maybe the R2 address itself? – Ron Maupin♦ Feb 15 '19 at 17:57
  • 1
    @RonTrunk could it be hosts in VLAN19, that are not actually part of the subnet you've specified and thereby not showing up on your ARP table? – user36472 Feb 15 '19 at 18:21
  • 1
    @cown Well, the traffic on R2's interface is about the same as R1, which leads me to believe that the traffic is going between them. If the traffic were going somewhere else, I wouldn't expect the numbers to match – Ron Trunk Feb 15 '19 at 18:23
  • 1
    @RonTrunk True. Depending on the model and OS, most of the newer Cisco devices have built-in packet capture capabilities, so you don't need to set up a span port or use a hub. Have you checked to see if you can just do that directly on the router? Usually something like "monitor capture" or just "capture" depending on the device type. – Jesse P. Feb 15 '19 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.