Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have 2 separate networks that I manage. They have a router between and layer 3 connection is working fine. Last week my DHCP servers started handing out IPs across the networks, looking around I figured that I have a layer 2 bridge somewhere, that I imagine a user plugged in.

How do I figure out what port this is connected to?

share|improve this question
When you find them give them a good kicking from me please. – Chopper3 Jan 10 '12 at 18:36
Here's the "rest of the story".... Turns out I'm the one that plugged it in. There was a switch that went belly up and I replaced it. I just plugged in every port on the patch panel that was labeled for that dept, turns out there was one port in that group that went to the other network... sigh... This place is sooo broken ;) – Kerry Hatcher Jan 12 '12 at 19:30
up vote 4 down vote accepted

Look at the MAC address table on the switch(es) for ports that have multiple MAC addresses registered. If you find any, go investigate those ports and see what's connected to them.

If you have multiple switches interconnected then you're going to have ports with multiple MAC addresses registered (on the ports linking the switches together). You can discount those but verify them to make sure.

The other thing I would suggest is to check the router config and make sure it's not configured as a DHCP relay.

share|improve this answer
You nailed it, but I went about it in a different way, I borrowed a Fluke Optiview and it did that for me. Thanks for pointing me in the right direction. Putting an Optiview in the budget for next year! – Kerry Hatcher Jan 12 '12 at 19:30
Glad to help... – joeqwerty Jan 12 '12 at 20:47

Aah, been there, done that :-)

First check that router to make sure it is not accidentally configured to act as dhcp relay (this feature is also known as ip-helper).

But the most likely cause is a user that (intentionally or not) connected a hub or unmanaged switch between ports of both LAN's.

If possible configure port-security on all access-ports (not on the up-links or on ports to which access-points connect!) of your switches for a relatively low number of allowed mac-addresses (5 or so). This will cause the offending port to go into error/disabled almost immediately. So you can easily tell which port has the offender and it will prevent any further re-occurrences in the future.

Then go hunting :-) I have found that walking into the offenders office with a baseball bat really gets their attention.

share|improve this answer
Right now this place has a nice hodge podge of switches that don't like each other. Luckily I've got funding for a brand new (3rd) network that is Cisco only, that will replace the other two. The legacy networks span multiple buildings accross an entire city and it is a flat network using 10.x and 191.x (yes I know, RFC 1918, don't get me started)... pulls hair out – Kerry Hatcher Jan 12 '12 at 19:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.