Excessive Broadcasts 169

[jamin100]

We're experiancing intermittant slow network performance so i thought id fire up wireshark to take a closer look,

 

I seem to be getting a lot of broadcasts from a single 169 address.

 

Any idea how i can narrow this device down?

 

[Ben-BSH]

So that looks like something got an APIPA address, and wants to communicate with something else on the network, can you ping -a 169.254.1.71 it and will it respond? (you might need to alter your network config to see it)

 

if you can ping it normally, then do an arp -a, get the Mac and see if you can match it to something in DHCP (if its lease is still around, assuming it had a valid IP once during the 8 day default lease time)

[FN-GM]

Is 169.x.x.x one of your internal network addresses? It shouldn't be if it is.

 

Run wireshark and you should be able to find the source IP address of the traffic. That should point you in the right direction.

[jamin100]

No, ours start 10.That screengrab is from wireshark

[FN-GM]

I can't see well on this phone screen. Can you see the source IP address?

[Domino]

Well, the hardware address is a hewlett-packard owned one - if that helps narrow it down?

 

How clever are your switches? for instance a cisco command of "show mac-address-table" would tell you what mac addresses are active on which ports, which would help

[IrritableTech]

Have you got any logs of your MAC addresses? I guess you're looking for the NIC with 00:1e:0b:4a:20:b6 (which could be a HP device?). Check DHCP logs and cross reference with DNS? We have all our machine macs within our cloning solution - that may be something you can look at?

 

If you are still unable to identify the device and it's causing you big issues then you need to start pulling switches out of your core until the traffic stops. Then go to that switch and start unplugging devices.

 

Dodgy printer NIC might be my guess looking at the info you gave us.

[jamin100]

hmm, no we dont have any mac address logs and have a lot of HP machines

Looks ike im going to have to go and start pulling things out ...

[IrritableTech]

Or do what @Domino suggested. If your your switches are hp as well - telnet in and run show mac-address

[jamin100]

Thanks, Ill look into that.

Have attached some more info from wireshark if that helps

[SkreeM1980]

To find the device that is causing the traffic on HP switches...

 

as others have said use show mac-address but for a logical process. Start at the core switch, show mac-addsess aabbcc-ddeeff this will give you a port number, then use show mac-address XX (port number) if multiple mac's are returned it is an uplink port, use show lldp info remote XX to find what switch is down that port, connect to that switch and start again, eventually you will get to a port with either only 1 mac, or a few macs but no LLDP info, goto that switch and find where the vcable from that goes, and somewhere in the vacinity of the end will be your device.