How to track a packet source in 6506

[griffin.wang]

Dear experts!

There was some pain my neck those days, that I found my 6506 sent a lot of ARP broadcast to address: 192.168.1.123(For security reason, I changed the address), but in fact, this address was not existence! It must be some one made this mistake, some one type a wrong address but didn't notice. It was unreasonable for 6506 sent so many broadcast. So I would like to check the real source of this data flow, how should I do?

Thanks a lot!

[Edison Ortiz]

You can configure NetFlow;

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/netflow.html

HTH,

__

Edison.