Seeing unexpected skinny heartbeats when sniffing IP phone's network traffic

Probably the fact that Ethereal is sniffing with its interface put in "promiscuous mode", and your switches are (mis-?)configured to work as non-switching hubs...

Enzo

Are they directed to broadcast addresses?

miguel

In reply to Enzo's message: I am sniffing in promiscuous mode so I can see the traffic going to and coming from the attached IP phone. I do not believe the switches are misconfigured. They are not acting like hubs (except in the cases where I am seeing these misdirected packets).

In reply to Miguel: The packets that I am seeing are not broadcast packets. They are directed to specific IP addresses and MACs that do not include the IP phone or the PC I am using for sniffing. I am seeing other broadcast traffic, but I am ignoring that.

The latest theory on this is that it is Unicast Flooding. This is supposedly a normal occurance when the switches MAC table gets filled up. When the switch has a packet for a MAC, but can't find the MAC in its table, it sends it out all its ports; not as a broadcast packet, but essentially a broadcast because it is sent out every port. We have looked at the MAC table in both switches and they are far from being full, so I don't know about this being the cause. I am continuing to look at the switch settings and Unicast Flooding to see if I can find an answer.

Thanks for your responses!

If the MAC table is not full then this seems unlikely. Also, unless there is nothing else happening on your network, you would see other traffic also coming out all interfaces, not just the VoIP stuff.

miguel

We are seeing a smattering of other TCP packets that I shouldn't be able to see. I've been concentrating on the skinny heartbeats because that is what I was more interested in.