Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an ACL to prevent regular workstations from accessing the management vlan on our switch. Every 5 minutes we get the following log entry:

%SEC-6-IPACCESSLOGS: list mgtvlan-acl denied 0.0.0.0 20 packets

The switch is a Cisco 3750G running IOS C3750-IPBASEK9-M, Version 12.2(52) SE

The acl is:

ip access-list standard mgtvlan-acl
permit [management workstation netowrk]
permit [other management networks]
deny any log

The acl is applied to the layer 3 interface called Vlan50

interface Vlan50
  description management vlan
  ip address 199.254.98.xx 255.255.255.192
  ip access-group mgtvlan-acl in

I've tried various debug commands and ip accounting on the vlan50 interface. I also turned on terminal monitor just to make sure I could see everything without relying on the syslog server.

Is there any way I can get more information on what these packets are or where they are coming from (which physical interface) without going through the hassle of setting up wireshark?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Two things I would do:

1) convert to an extended ACL so you can log destination IP address

2) see if your switch supports the 'log-input' argument at the end of an access expression. Log input records the source Mac of the frame which will help you find the culprit.

As mentioned above dhcp is a good guess based on the data you have so far

share|improve this answer
    
Perfect. I created an identical extended ACL and got the mac address. Mac table lookup showed the port. The nic on the server isn't being used and kept trying to get an IP. –  murisonc Apr 26 '13 at 19:29

if it helps, that's the message I would expect if something on the management vlan was trying to contact a dhcp server.

share|improve this answer
    
Going to check into that tomorrow. –  murisonc Mar 26 '13 at 0:09
    
Finally got around to this. Yes it is something trying to contact a dhcp server. However the other answer explained how to find the source. –  murisonc Apr 26 '13 at 19:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.