Cassidy deduced the MAC earlier in the thread. I found that thread in the switch table to determine which AP it was. I confirmed it was found in the bridge table of the AP on the WLAN0 interface. From there there isn't an easy way to trace it to a single radio. I used to log into each radio and check its bridge table for the MAC but now I run a script to dump all of the bridge tables to all the radios and grep for the offending mac. Led me right to the right IP address.
-Ty -Ty On Fri, Feb 19, 2016 at 8:29 PM, Sterling Jacobson <sterl...@avative.net> wrote: > How did you trace that to the customer/port? > > > > *From:* Af [mailto:af-boun...@afmug.com] *On Behalf Of *Ty Featherling > *Sent:* Friday, February 19, 2016 7:05 PM > *To:* af@afmug.com > *Subject:* Re: [AFMUG] IPv6 traffic to ff02::1:2 > > > > Forgot to update: had the customer reboot his router and the traffic > disappeared. Watching it carefully for a return but good for 24 hrs so far. > > -Ty > > On Feb 18, 2016 2:33 PM, "David" <dmilho...@wletc.com> wrote: > > I like this guy! > > On 02/18/2016 12:21 PM, Chris Wright wrote: > > It just really, REALLY wants everyone to know it exists. Cute little thing. > > > > Set it on fire. > > > > Chris Wright > > Network Administrator > > Velociter Wireless > > 209-838-1221 x115 > > > > *From:* Af [mailto:af-boun...@afmug.com <af-boun...@afmug.com>] *On > Behalf Of *Ty Featherling > *Sent:* Thursday, February 18, 2016 10:08 AM > *To:* af@afmug.com > *Subject:* Re: [AFMUG] IPv6 traffic to ff02::1:2 > > > > Found the offending customer and looking at their radio I can see the > actual traffic is about 5Mbps worth but the traffic shaping knocks it down > to 1.5 before it reaches our network. Makes me think this is more like a > malfunctioning router than a feature. > > > > -Ty > > > > > > > -Ty > > > > On Wed, Feb 17, 2016 at 2:43 PM, Ty Featherling <tyfeatherl...@gmail.com> > wrote: > > 1 layer 2 network per tower. All APs and CPE bridged to that one broadcast > domain. > > > > -Ty > > > > > > > -Ty > > > > On Wed, Feb 17, 2016 at 2:32 PM, Cassidy B. Larson <c...@infowest.com> > wrote: > > How big is your layer2 network? Ideally, with multicast, your switch > should only be sending it to the hosts that subscribe to that multicast IP. > > > > > On Feb 17, 2016, at 10:54 AM, Ty Featherling <tyfeatherl...@gmail.com> > wrote: > > > > So it's DHCPv6 discovery? Why the hell so much traffic then? If I can > find the source radio I will definitely turn off multicast. Good idea. > > > > > > > > > >
