Welcome, Guest. Please login or register.

Author Topic: strange nodes distribution on some access ports  (Read 1676 times)

networkbo

  • Newbie
  • *
  • Posts: 34
    • View Profile
strange nodes distribution on some access ports
« on: August 27, 2021, 06:56:49 pm »
Dear all,
I see on Nedi that on some ports a lot of nodes are mapped in same moments, also 90 mac-addresses on same ports, discovered more or less at same time. I don't think a user connected a switch, ports are in offices where users do not use industrial switch o similar devices.
I ask if someone experienced similiar issues and if it could be some strange behaviour of NeDi.

networkbo

  • Newbie
  • *
  • Posts: 34
    • View Profile
Re: strange nodes distribution on some access ports
« Reply #1 on: November 12, 2024, 12:30:53 pm »
Noone has this strange behaviour?

rickli

  • Administrator
  • Hero Member
  • *****
  • Posts: 2906
    • View Profile
    • NeDi
Re: strange nodes distribution on some access ports
« Reply #2 on: December 04, 2024, 10:22:44 am »
Try changing the patch cable. A faulty connection can lead to such effects, when the switch learns errorous MAC addresses. Do you see those MACs on the switch CLI?
Please consider Other-Invoices on your NeDi installation for an annual contribution, tx!
-Remo

primethios

  • Newbie
  • *
  • Posts: 6
    • View Profile
Re: strange nodes distribution on some access ports
« Reply #3 on: February 18, 2025, 04:53:14 am »
This may sound stupid but, do you use IP phones?  I was recently on a contract at a large industrial site (hundreds of buildings, thousands of devices) and was seeing crazy amounts of mac addresses showing up on edge ports.  What I found was that recently various desktop switches were "upgraded" but they chose to not replace with POE capable switches which killed the phone in those offices so they plugged the phone into the uplink port to get POE and then plugged the desktop switch into the "PC port" of the phone which caused some crazy mac tables.  After this I also found areas where phones were deployed with POE injectors or just regular power supplies and then someone mixed up and ran the uplink from the PC port of the phone.  I even caught one of my peers (another Sr. Network engineer mind you) with the same issue at his desk as he was building a test bed in his office.  So effectively it can replicate the same type issues as an undocumented/misconfigured/unmanaged switch connected to the network since the PC ports on phones (these were Cisco desk phones in this situation).  CDP and LLDP info helped me determine some of this remotely but more than likely you will likely need to physically investigate the "device" on the far end of the cable.  It may take some electronic legwork but looking at CDP/LLDP info, mac vendor lookup, etc you might get a view of what may be the source device of oddness.