Header Only - DO NOT REMOVE - Extreme Networks

IGMP v1 query received in logs...


Userlevel 1
Hello, In one of our x450-G2-48t-10G switch getting IGMP v1 query continously from the IP address 192.168.1.1. This query is receiving in one particular vlan. We are using 10.x.x.x IP series for this vlan. We don't know where is the source 192.168.1.1 Apart from this, we are getting packet drop in the same vlan. Is IGMP v1 query cause Packet drop? Please help us to resolve issue. Thanks.

4 replies

Userlevel 7
Please post a screenshot of the log with some of this messages and the output for "show vlan" and which version is running on the switch.
Userlevel 6
Easy way to find this is use wireshark or your favorite sniffer on a switch port where this vlan is untagged .. Find the mac address of 192.168.1.1 and you can track that to it's source port. Sounds like someone plugged a small router into your that vlan somewhere.

As far as packet loss being caused by this... I doubt it. Packet loss will need to be narrowed down and looked at as a separate issue
Userlevel 2
EtherMAN wrote:

Easy way to find this is use wireshark or your favorite sniffer on a switch port where this vlan is untagged .. Find the mac address of 192.168.1.1 and you can track that to it's source port. Sounds like someone plugged a small router into your that vlan somewhere.

As far as packet loss being caused by this... I doubt it. Packet loss will need to be narrowed down and looked at as a separate issue

Or easiest way imo is to create interface on this vlan with ip 192.168.1.x and check in arp which mac have ip 192.168.1.1.
Userlevel 1
EtherMAN wrote:

Easy way to find this is use wireshark or your favorite sniffer on a switch port where this vlan is untagged .. Find the mac address of 192.168.1.1 and you can track that to it's source port. Sounds like someone plugged a small router into your that vlan somewhere.

As far as packet loss being caused by this... I doubt it. Packet loss will need to be narrowed down and looked at as a separate issue

Sir,
Thanks for the information. We found the source port using arp. After disabling the port there is no IGMP v1 query logs. Thanks. We need to know few things...
1. Is IGMP v1 query cause Packet drop?
2. Source port is not listed while entering "sh iparp vlan". How to identify the client device which is connected the source port.

Thanks for the support.

Reply