I tracked it down via port mirror on the vlan and WireShark. It turns out to be an Apple mini server with Windows OS and is sending LLMNR packets intermittently. Looking at Google it appears this can be shut off. Walt
>>> Erik Auerswald <[email protected]> 7/12/2012 3:34 PM >>> Hi, the IP addresses in 169.254.0.0/16 are link-local (see RFC 3927), usually self-assigned by a PC configured for DHCP which did not receive a DHCP reply. If theses addresses are active long enough, they can be found with a compass search. They have to send some packets at the right time to be picked up by the switch. You can track them down individually by assigning a link-local IPv4 address to the respective VLAN interface, pinging the IP address to track down (refreshes ARP table) and then get the MAC address from ARP table entry for this IP. The MAC address should then show up in a fresh compass search. Remove the link-local IPv4 address from the VLAN interface afterwards. Regards, Erik -- Dipl.-Inform. Erik Auerswald http://www.fg-networking.de/ E:[email protected] P:+49-631-4149988-0 M:+49-176-64228513 Gesellschaft für Fundamental Generic Networking mbH Geschäftsführung: Volker Bauer, Jörg Mayer Gerichtsstand: Amtsgericht Kaiserslautern - HRB: 3630 On 07/12/2012 08:56 PM, Walter Witkowski wrote: > I have the following showing up in the S4 core log > > in Report on vlan 843, port tg.2.7 > <165>Jul 11 20:28:28 172.31.0.21 IPmcast[2]IGMP: Invalid source IP 169.254.52.83 > in Report on vlan 843, port tg.2.7 > <165>Jul 11 20:33:07 172.31.0.21 IPmcast[2]IGMP: Invalid source IP 169.254.52.83 > in Report on vlan 843, port tg.2.7 > <165>Jul 11 20:46:52 172.31.0.21 IPmcast[2]IGMP: Invalid source IP 169.254.52.83 > in Report on vlan 843, port tg.2.7 > <165>Jul 12 03:21:05 172.31.0.21 IPmcast[2]IGMP: Invalid source IP 169.254.132.1 > 39 in Report on vlan 741, port tg.2.2 > <165>Jul 12 07:00:40 172.31.0.21 IPmcast[2]IGMP: Invalid source IP 169.254.198.9 > 8 in Report on vlan 843, port tg.2.7 > <165>Jul 12 07:09:45 172.31.0.21 IPmcast[2]IGMP: Invalid source IP 169.254.65.77 > in Report on vlan 843, port tg.2.7 > <165>Jul 12 07:17:16 172.31.0.21 IPmcast[2]IGMP: Invalid source IP 169.254.231.1 > 84 in Report on vlan 741, port tg.2.2 > <165>Jul 12 07:30:59 172.31.0.21 IPmcast[2]IGMP: Invalid source IP 169.254.126.1 > 37 in Report on vlan 843, port tg.2.7 > <165>Jul 12 07:45:29 172.31.0.21 IPmcast[2]IGMP: Invalid source IP 169.254.79.14 > 2 in Report on vlan 741, port tg.2.2 > <165>Jul 12 08:18:39 172.31.0.21 IPmcast[2]IGMP: Invalid source IP 169.254.207.1 > 9 in Report on vlan 742, port tg.2.6 > <165>Jul 12 08:30:21 172.31.0.21 IPmcast[2]IGMP: Invalid source IP 169.254.251.5 > > Netsight does not give results for compass searches on these IP's. Anyone have a suggestion as to how this source may be located. > > > thanks > > > Walt Witkowski Primary Network Specialist - Office of Information Technology - Delaware County Community College > ellucianTM > 610-359-5017(phone) / 610-359-4123 (fax) / 856-217-4430(cell) > [email protected] > [email protected] > www.ellucian.com > > --- > To unsubscribe from enterasys, send email to [email protected] with the body: unsubscribe enterasys [email protected] --- To unsubscribe from enterasys, send email to [email protected] with the body: unsubscribe enterasys [email protected] --- To unsubscribe from enterasys, send email to [email protected] with the body: unsubscribe enterasys [email protected]
