169 broadcasting

[GoodheadDC]

have noticed on some of our edge swithes alot of network chatter.

This got me thinking maybe somethink broadcasting.

 

have used wire shark and have noticed that in a 5 second capture there was nearly 50 entries from a hp device that has 169. address and is looking for other 169 address.

 

so clearly is using auto dhcp thingy.

 

could this be slowing the network down, is this worrying about?

 

finding it hard to trach the device down.

[jonnykewell1]

does it give you a mac address? you could load up your dhcp scope and try track it from there.

[jonnykewell1]

or change your pc to a static 169 ip address on the same range then do a ping -a on the ip address and see if it returns a hostname.

[GoodheadDC]

does it give you a mac address? you could load up your dhcp scope and try track it from there.

 

have looked in dhcp.

closest mac is linked to a hp server we have running citrix.

[jonnykewell1]

got any virtual servers? Not a virtual network card or something like that?

[GoodheadDC]

yes we do have some virtual servers.

 

everythink that runs on vm is working. otherwise users would be letting us know.

 

got any virtual servers? Not a virtual network card or something like that?

[Destinova]

Many printer models use a multicast to find other printers on the network, very similar to Bonjour or UPnP. That being said it would not be using a link-local address.

[GrumbleDook]

have looked in dhcp.

closest mac is linked to a hp server we have running citrix.

Have you tried MACVendorLookup.com - Mac Address OUI Vendor/Manufacturer Lookup to find the manufacturer?

[mac_shinobi]

If its a HP printing device they normally do a bit of software that will scan the network and show you all the printing devices which should show you the mac addresses of each device ( assuming it can pickup the one that is getting an APIPA address ) ?

 

Short of that go around and disconnect all HP devices minus your citrix server ( if they are printers or desktop pc's ) ??

 

Download a demo / trial of LANView and scan your network with that, should be able to click on the mac address column and sort by mac address, then find it in that list and should hopefully help narrow down which device it is : http://www.jxdev.com/index.htm

Edited August 7, 2012 by mac_shinobi

[cpjitservices]

169 ? isnt that a windows reserved address ? - is something mis-configured ? I'd download Solarwinds IP Tracker and do a scan on the subnet and see what it comes up with.

[Michael]

169 is allocated when a DHCP server cannot be found or because your DHCP scope is full. The other possibility is the subnet and gateway are incorrect also, hence why it's 'attempting' to find other devices to allocate a real IP.

[mac_shinobi]

169 is allocated when a DHCP server cannot be found or because your DHCP scope is full. The other possibility is the subnet and gateway are incorrect also, hence why it's 'attempting' to find other devices to allocate a real IP.

 

Presumably that is an APIPA --> What's APIPA?

[Michael]

Presumably that is an APIPA --> What's APIPA?

 

Yep, that's the one

[AngryTechnician]

Does that HP server have a LOM card in it? They usually require their own IP address independent of the server. Not sure why it wouldn't be picking one up though.

[oxide54]

confused me with LOM (also known as iLO to some people !)

[GoodheadDC]

that confirms its definatly hp.

 

 

Have you tried MACVendorLookup.com - Mac Address OUI Vendor/Manufacturer Lookup to find the manufacturer?

[m25man]

You need you perform a switch map discovery, this is done at Layer2 by analysing the ARP tables on each switch.

 

You can use tools like Solarwinds, LanSurveyor etc Google switch port mapping and several crawl out of the woodwork.

You may also need to configure SNMP correctly in order to get it to work properly.

 

Most managable switches have tools for ARP tables you can normally work out from these manually what is on the end of each port.

 

With the correct tools this type of error is traced and rectified in a couple of minutes.

Unfortunately the best tools cost the most.

[Destinova]

Don't bother paying for any kind of switch port mapping software. You can easily find out the IP and MAC associated with any switchport with builtin tools. Your router/gateway/L3switch will show you the MAC address from it's ARP table, and your switches will show you which port that MAC belongs to. On Cisco gear it's this easy:

 

show arp (on the router)

 

show mac-address-table (on the switch)

 

In this case doing that may be a waste of time anyway, since you may be dealing with a virtual machine or a wireless device. Your trace will point to a trunk connecting a VM host or a wireless access point.