Re: Bogon IPs traffic only seen by netflow, confined within a VLAN only

[tsteeves]

Take an IP from the source host network and add it as a secondary IP on the 
routed interface for the vlan - for the 0.10.94.27 host add "ip address 
0.10.94.254 secondary" to the router. Then do a broadcast ping from the router 
- ping 0.10.94.255. Then show the arp cache for the vlan - show ip arp vlan xxx 
| include 0.10.94. - Do you see any entries besides the router interface? If 
no, you probably have a misconfigured/buggy device on the network. If  there 
are entries, you will be provided with MAC addresses which you can track down 
easily to the switchport in question. I use this technique to track down rougue 
DHCP servers, Access Points etc.