3

I have a device - an old printer I think - that is showing up in my traffic flows. It is from a decommissioned subnet (100.100.100.0/24). It is passing one of my network taps and triggering alerts. The tap is on the link between my primary user switch and the switch providing server & internet access. The switches are Cisco 3750X.

Usually I'd just run a sh arp and sh mac address-table to identify the port of a problematic device, but I'm not seeing any entries here.

I've tried adding back the old gateway to the default vlan - how it was previously configured - and doing a ping sweep. I also tried assigning a static IP to a test VM and doing a port scan against that IP, iterating through the various VLANs we have defined.

How can I isolate what port this device is connected to? I'm out of ideas.

EDIT:

I'm aware of the need for recent traffic for looking at the arp cache to be useful, and how to track it back down through multiple switches. I've been thinking about a packet capture, but I don't have a ready way to attain one. I don't have a spare ten gig fiber interface and tap sitting around, and I can't take my monitoring offline long enough for this to reproduce itself.

Going back to arp to locate the issue.. The biggest problem I'm having is the idea of "ping from the same subnet". That's exactly what I'm trying to do. I have a VM that I've assigned 100.100.100.100, with a ping -t 100.100.100.101. I'm moving it through the various VLANs that the device may be on and watching the arp table with sh arp | include 100.100.100. I never see a complete address returned.

  • Are you sure you're not dealing with a spoofed IP address? – Teun Vink Mar 27 at 20:54
  • @Teun, I doubt it. That range was used internally till a few years ago and we still have some ancient hardware. The attempts to hit a Xerox owned IP sound like a device phoning home. – Tim Brigham Mar 28 at 1:42
5

show arp only shows end nodes that the switch had IP communication with recently. Usually that happens only for management traffic or when a layer-3 switch is the default gateway. Switching on layer 2 doesn't populate/update the switch's ARP table. It does update the MAC table, however.

Just ping the IP address from the same subnet (or from the switch if you like) and then look up the local ARP cache. (For a remote subnet, check the ARP cache in the gateway router.)

Note the MAC and then show mac address-table will show you which port the node is connected on. If that's a downlink or an uplink port run a show mac address-table on the connected switch until there's a port with a single MAC.

If the packets are spoofed, a packet capture can reveal the source. The frame containing the packet will show the source MAC address from either the spoofing node or from the gateway it came through. Repeat packet capture in the previous segment until you've found the source.

Note that MAC addresses can be forged very easily, but a switch will have it in its table nonetheless.

4

So.. I did some additional digging on this. Apparently there are a lot of models of Xerox printers / scanners / etc (7855, C60, EX7750....) that have the default IP of 100.100.100.101.

I just had the unfortunate luck that the same subnet was used in my environment when it was set up around 20 years ago.

The implementation of the network stack on these devices results in that IP still showing up in a capture even if a different static IP is assigned.

In the end it was due to the scheduling I found it. I would see traffic from 100.100.100.101 and the real IP at 192.168.X.37 milliseconds apart. From there I found references to that default IP in old forum posts and manuals.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.