Identify source address?

Unanswered Question
Feb 20th, 2007

I have a Tachyon satellite backup router connected to a 3750 switch port that seems to be getting traffic from somewhere. I don?t have a sniffer at that location. Does anyone have any tricks that would allow me to identify where this traffic is coming from? I thought about using a MAC ACL and a Vlan map, denying all traffic and logging the output until I found out that Vlan maps do not support logging. This is a switched port, not a routed port. Either ource MAC or IP would be fine.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
albert.remo Tue, 02/20/2007 - 21:06

Hi!

Good day! IP accounting is a good IOS tool but unfortunately, as I've checked, this is not supported on the 3750 switch. What you can do is configure SPAN then use a protocol analyzer from your PC. Ethereal is a good tool and if I'm not mistaken can be downloaded free.

Hope this helps,

Regards,

Albert

jedavis Wed, 02/21/2007 - 06:12

Thank you for the reply Albert.

Actually, I think IP accounting IS supported on the 3750, but this doesn't help on a switched port where IP processing does not take place.

I am very familiar with Ethereal and I may have to resort to having someone at the site load it onto something, but I was hoping for a quick and dirty method from the switch command line.

FYI Ethereal, while still available by that name, is no longer being supported. It is now known as Wireshark and is available from http://www.wireshark.org/. I think there were some trademark disputes or something.

-Jeff

Actions

This Discussion