I have an ACL to prevent regular workstations from accessing the management vlan on our switch. Every 5 minutes we get the following log entry:
%SEC-6-IPACCESSLOGS: list mgtvlan-acl denied 0.0.0.0 20 packets
The switch is a Cisco 3750G running IOS C3750-IPBASEK9-M, Version 12.2(52) SE
The acl is:
ip access-list standard mgtvlan-acl permit [management workstation netowrk] permit [other management networks] deny any log
The acl is applied to the layer 3 interface called Vlan50
interface Vlan50 description management vlan ip address 199.254.98.xx 255.255.255.192 ip access-group mgtvlan-acl in
I've tried various debug commands and ip accounting on the vlan50 interface. I also turned on terminal monitor just to make sure I could see everything without relying on the syslog server.
Is there any way I can get more information on what these packets are or where they are coming from (which physical interface) without going through the hassle of setting up wireshark?