Here is a routing puzzle:

I'm working on a poorly documented network, and I'm trying to document things as I discover them. R1 is a core L3 switch. R2 is a router. The FW is a, well, firewall.

enter image description here

On R1, I see traffic (about 1Mbps) in and out on vlan 19, and it's fairly constant:

R1#sh int vl 19
Vlan19 is up, line protocol is up
  Hardware is EtherSVI, address is 0008.e3ff.fd90 (bia 0008.e3ff.fd90)
  Internet address is
  5 minute input rate 1175000 bits/sec, 1770 packets/sec
  5 minute output rate 1161000 bits/sec, 1751 packets/sec

The only devices that are in the ARP table on that subnet are R1 and R2. The FW seems not to be receiving any traffic:

R1#sh arp | i 10.76.85
Internet              -   0008.e3ff.fd90  ARPA   Vlan19
Internet             13   00d7.8fcb.2400  ARPA   Vlan19

However, there is no route on R1 where the next hop is R2. There is only the connected interface:

R1#sh ip ro | i 10.76.85
C is directly connected, Vlan19
L is directly connected, Vlan19

So how to explain the outbound traffic?

R2 also has only two devices in its ARP table:

R2#sh arp | i 10.76.85
Internet             17   0008.e3ff.fd90  ARPA   TenGigabitEthernet0/0/0
Internet              -   00d7.8fcb.2400  ARPA   TenGigabitEthernet0/0/0

R2 Does have a route (static) with R1 as the next hop:

R2#sh ip ro | i 10.76.85
S [1/0] via
C is directly connected, TenGigabitEthernet0/0/0
L is directly connected, TenGigabitEthernet0/0/0

This could explain one way traffic from R2 to R1, but I see outbound traffic from R1 to ...?

These are 10G interfaces, so I can't easily plug a sniffer in. I will eventually be able to span a port and look at the traffic, but until then I'm puzzled. Anyone have any theories?

  • 2
    Is the destination maybe the R2 address itself?
    – Ron Maupin
    Feb 15 '19 at 17:57
  • 1
    @RonTrunk could it be hosts in VLAN19, that are not actually part of the subnet you've specified and thereby not showing up on your ARP table?
    – user36472
    Feb 15 '19 at 18:21
  • 1
    @cown Well, the traffic on R2's interface is about the same as R1, which leads me to believe that the traffic is going between them. If the traffic were going somewhere else, I wouldn't expect the numbers to match
    – Ron Trunk
    Feb 15 '19 at 18:23
  • 1
    @RonTrunk True. Depending on the model and OS, most of the newer Cisco devices have built-in packet capture capabilities, so you don't need to set up a span port or use a hub. Have you checked to see if you can just do that directly on the router? Usually something like "monitor capture" or just "capture" depending on the device type.
    – Jesse P.
    Feb 15 '19 at 18:25
  • 1
    @effenok It means "local Interface."
    – Ron Trunk
    Sep 8 at 12:08

If a router doesn't know a route to a certain IP, it would only forward it to a destination for which it has a default route. But with some devices you can also set to flood the traffic to a certain interface without a next-hop IP, so check if there is any sort of a default route set.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.