many strange MAC addresses on switch ports

Bad NIC or other transmitter sending rubbish?

Malicious code designed to make the forwarding database?

Bad switch?

Noise? - seems unlikely.

Maybe we can find a switch where this happens at regular intervals. At the moment I can't find a rule, different switches, different ports, different clients...

Ralf

Add overflow. Malicious code designed to make the forwarding database overflow?

There is one port with 2400 of these addresses, but on most of the other affected ports the number of addresses is less than 100. I would assume that if someone really wants to flood the switch he would use much more addresses.

Ralf

Sorry, I just read the OP more carefully.

The absolute first thing to do is to confirm that the problem is not with the 'disco' software.

You can use:

sh mac-a !

Depending on your security requirements, you might want to consider assuming that you have malicious code in the network until you can prove otherwise.

Find a device that is apparently sending these frames and SPAN or Monitor it's port. The frames should show up on the sniffer. You can use Ethereal which is free. SPAN a lot of ports (to a fast port) and save the traffic to files. When you see the addresses appear look at the relevant files.

I find that Ethereal gets indigestion with more than about 50M or 100M of captured data so keep each file less than that. It is easy to configure Ethereal to save in 50M chunks.

Am Thu, 20 Oct 2005 02:23:56 -0700 schrieb anybody43:

I know that ;)

Today I was able to see some of those odd addresses 'live' popping up on one switch port. At the moment I think that this might be a problem of some of our clients (nic, os..).

Either that or a odd client. We'll take a look at the clients that are connected to those ports.

Ralf