Been taking some packet captures directly via the command-line on the switch and seeing traffic that I wouldn’t expect. To take one example, I had a port that was experiencing a problem, it was actually negotiating at 10Mb full instead of 1Gb. When I looked at the QoS monitor I could see the QP8 counter incrementing, so thought I would take a look at what that traffic was. Although the result are below I am seeing the same on other ports.
I took a packet capture of the port directly on the switch using the following command:
debug packet capture ports 3:46 on cmd-args "-c 1000"
This is an X450G2 stack, running version 18.104.22.168
Here is an example of what I am seeing below:
10.65.232.250 is the management IP address of the switch itself.
10.65.232.252 is the physical address of the Management VLAN (just for this stack) on one of the cores for this switch.
10.65.80.252 is the physical address of the Voice VLAN on one of the cores for this switch.
So the network seems to be running fine, CPU on cores is about 2.5% and the edges about 5%. When I look at the packet captures of the ports and CPU’s I’m seeing odd things and trying to understand whats going on.
Take the example below, this is from the same port capture just filtered for VRRP. I’m seeing VRRP hellos every second as you would expect, but I'm seeing them 3 at a time?
I’m also seeing VRRP hellos for the Voice VLAN (10.65.80.252) that isn’t tagged on this port but being sent perhaps 30 times in one second?
So I’m unsure 1st why I am seeing this traffic on a port capture and why I’m seeing the traffic I am? Looks like a problem, possible loop but can't find the source. I'm seem to be getting the same results in other places but nothing is common, i.e. on a different switch I see the same thing but for the VLANs on that switch?
Here is an overview of the topology:
The summary of the network is that there are 2 different buildings A & B, each have a pair of cores MLAG'ed together. There is a VRID per site for VLANs in that building only and a common VRID for the VLANs that are common on each core. This is configured with fabric routing and OSPF. The stack in question would be one in the top right.
The switches at the top are legacy Cisco switches, they are currently connected using VRRP VRID 101 (VLAN 999).Just wondering if anyone had any suggestions?