I have a device - an old printer I think - that is showing up in my traffic flows. It is from a decommissioned subnet (100.100.100.0/24). It is passing one of my network taps and triggering alerts. The tap is on the link between my primary user switch and the switch providing server & internet access. The switches are Cisco 3750X.
Usually I'd just run a
sh arp and
sh mac address-table to identify the port of a problematic device, but I'm not seeing any entries here.
I've tried adding back the old gateway to the default vlan - how it was previously configured - and doing a ping sweep. I also tried assigning a static IP to a test VM and doing a port scan against that IP, iterating through the various VLANs we have defined.
How can I isolate what port this device is connected to? I'm out of ideas.
I'm aware of the need for recent traffic for looking at the arp cache to be useful, and how to track it back down through multiple switches. I've been thinking about a packet capture, but I don't have a ready way to attain one. I don't have a spare ten gig fiber interface and tap sitting around, and I can't take my monitoring offline long enough for this to reproduce itself.
Going back to arp to locate the issue.. The biggest problem I'm having is the idea of "ping from the same subnet". That's exactly what I'm trying to do. I have a VM that I've assigned 100.100.100.100, with a
ping -t 100.100.100.101. I'm moving it through the various VLANs that the device may be on and watching the arp table with
sh arp | include 100.100.100. I never see a complete address returned.