2 networks with a layer 2 bridge that shouldn't be there.

Question

I have 2 separate networks that I manage. They have a router between and layer 3 connection is working fine. Last week my DHCP servers started handing out IPs across the networks, looking around I figured that I have a layer 2 bridge somewhere, that I imagine a user plugged in.

How do I figure out what port this is connected to?

Here's the "rest of the story".... Turns out I'm the one that plugged it in. There was a switch that went belly up and I replaced it. I just plugged in every port on the patch panel that was labeled for that dept, turns out there was one port in that group that went to the other network... sigh... This place is sooo broken ;) — Kerry Hatcher, Jan 12 '12 at 19:30

score 4 · Accepted Answer · answered Jan 10 '12 at 18:33

4

Look at the MAC address table on the switch(es) for ports that have multiple MAC addresses registered. If you find any, go investigate those ports and see what's connected to them.

If you have multiple switches interconnected then you're going to have ports with multiple MAC addresses registered (on the ports linking the switches together). You can discount those but verify them to make sure.

The other thing I would suggest is to check the router config and make sure it's not configured as a DHCP relay.

answered Jan 10 '12 at 18:33

joeqwerty

108,377
6
80
171

You nailed it, but I went about it in a different way, I borrowed a Fluke Optiview and it did that for me. Thanks for pointing me in the right direction. Putting an Optiview in the budget for next year! – Kerry Hatcher Jan 12 '12 at 19:30
Glad to help... – joeqwerty Jan 12 '12 at 20:47

score 0 · Answer 2 · answered Jan 10 '12 at 19:39

Aah, been there, done that :-)

First check that router to make sure it is not accidentally configured to act as dhcp relay (this feature is also known as ip-helper).

But the most likely cause is a user that (intentionally or not) connected a hub or unmanaged switch between ports of both LAN's.

If possible configure port-security on all access-ports (not on the up-links or on ports to which access-points connect!) of your switches for a relatively low number of allowed mac-addresses (5 or so). This will cause the offending port to go into error/disabled almost immediately. So you can easily tell which port has the offender and it will prevent any further re-occurrences in the future.

Then go hunting :-) I have found that walking into the offenders office with a baseball bat really gets their attention.

Right now this place has a nice hodge podge of switches that don't like each other. Luckily I've got funding for a brand new (3rd) network that is Cisco only, that will replace the other two. The legacy networks span multiple buildings accross an entire city and it is a flat network using 10.x and 191.x (yes I know, RFC 1918, don't get me started)... _pulls hair out_ — Kerry Hatcher, Jan 12 '12 at 19:36

2 networks with a layer 2 bridge that shouldn't be there.

2 Answers2