Xerox-000000 anyone help??

[j.lipsett]

When siffing my IP network I came accross Xerox-000000 producing a good bit of traffic. The sniffer did not pick up any more info on this. I have checked all the xerox printers and only IP is configured. Has anyone came accross this address before?

[lgijssel]

It is most likely a mac adress from vendor Xerox. Having the last three octets all zero's is not a normal mac-adress.

Could this be some Xerox proprietary protocol that is still enabled?

What is the destination adress for this traffic?

Regards,

Leo

[j.lipsett]

Hi Leo

The funny thing is that the sniffer only shows the above address and how may packets it's sending, no destination info. I have checked all Xerox devices for IPX etc and found one or two, but I have disabled IPX. Only IP configured on Xerox devices. See attachement 3 device down.

[lgijssel]

Please adjust your sniffer. The report that is shown gives you the host that source the most traffic, with the Xerox appearently in 2nd place. You need to get a packet trace report. This gives you the source and dest for packets on the network.

Please also check the way in which the sniffer is connected to the network. When you have a switched network, and the sniffer is plugged in to a random port, you will only observe broadcast, multicast and unknown traffic. You will definitely NOT see all traffic on the network due to the nature of a switch. That is: Unicast traffic will be directly switched from source to destination port. (and hence not show up on the monitored interface)

Regards,

Leo

[j.lipsett]

Leo

i should have toll you that the sniffer is plugged into a SPAN port and is seeing all traffic. I will setup a trace looking for above MAC address.

[pciaccio]

You need to determine where this traffic is coming from. If your sniffer cannot help then try using the swithes you have. Some commands to try:

Show TOP (For CATOS high end switches) to determine the top talkers of your switch.

Set IP accounting on the interface. (shows you the packets per user through the interface.

Set cache flow on the interface (CEF must be enabled) This shows you the traffic flows through the interface and ports used and size of the packets.

Maybe these tips can direct you to the culprit..Good Luck...

[j.lipsett]

Hi pciaccio

I have over 60 switches so this may take some time. thank for the help, if I find anything I let you know.

cheers