Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-10 Thread John Neiberger
This all has to be a problem on the SBC. I've only been peripherally involved up until now and I just found out they have another SBC in the same VLAN on the same pair of switches and it is not having a problem and is not experiencing this mad MAC address behavior at all. It's perfectly stable. Tha

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-10 Thread John Neiberger
Here's an example of what I'm talking about. The MAC learning log has been stable since they reloaded the SBC on Saturday: show ethernet-switching mac-learning-log | match 3c:91 Sat Jul 23 12:05:22 2011 vlan_name sbc-core mac 00:08:25:fa:3c:91 was learned on xe-0/1/1.0 Sat Apr 13 04:24:15 2013 v

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-10 Thread John Neiberger
I was just checking again and I'm really having difficulty reconciling the conflicting information reported by the switch. The output of "show ethernet mac-learning-log" is stable and the MAC addresses show as learned on the expected interfaces. However, we created firewall filters to count frames

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-10 Thread John Neiberger
I think they do have them configured differently, but they swear they don't and I don't have the access or the knowledge on that platform to disagree with them. The network side is straightforward switching. You are correct that we have multiple groups managing these devices. This group is the only

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-10 Thread Phil Mayers
On 06/09/2013 04:59 PM, John Neiberger wrote: We have several of these throughout our network and we're only seeing this problem in a couple of cases. The rest work just fine. Most of the SBCs are Obvious question: are you sure those two aren't configured different (wrongly) compared to the o

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-09 Thread John Neiberger
; > -- > *From:* John Neiberger > *To:* Georgios Vlachos > *Cc:* juniper-nsp@puck.nether.net > *Sent:* Saturday, June 8, 2013 9:32:19 PM > > *Subject:* Re: [j-nsp] What is this ethernet switching trace telling us? > > We added a firewall filt

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-09 Thread Serge Vautour
stant move of the same MAC. Serge From: John Neiberger To: Georgios Vlachos Cc: juniper-nsp@puck.nether.net Sent: Saturday, June 8, 2013 9:32:19 PM Subject: Re: [j-nsp] What is this ethernet switching trace telling us? We added a firewall filter to

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-08 Thread John Neiberger
gt; > > > -Original Message- > From: juniper-nsp [mailto:juniper-nsp-boun...@puck.nether.net] On Behalf > Of > John Neiberger > Sent: Saturday, June 08, 2013 4:16 PM > To: Gavin Henry > Cc: juniper-nsp@puck.nether.net > Subject: Re: [j-nsp] What is this ethernet

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-08 Thread Georgios Vlachos
Behalf Of John Neiberger Sent: Saturday, June 08, 2013 4:16 PM To: Gavin Henry Cc: juniper-nsp@puck.nether.net Subject: Re: [j-nsp] What is this ethernet switching trace telling us? This is an Acme Packet chassis. I really have no idea what it has running on it, but I'll find out from our voic

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-08 Thread John Neiberger
This is an Acme Packet chassis. I really have no idea what it has running on it, but I'll find out from our voice team. Thanks! On Jun 8, 2013 1:35 AM, "Gavin Henry" wrote: > Hi John, > > We (SureVoIP) have seen this on some of our hosted SIP servers which > run on Linux with multiple interfaces

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-08 Thread Gavin Henry
Hi Phil, Thanks. Yes, we used those too. Forgot to say. There are a few more iirc in there. Gavin. On 8 Jun 2013 09:54, "Phil Mayers" wrote: > On 06/08/2013 08:35 AM, Gavin Henry wrote: > > your email to /etc/aliases. We found that the Linux kernel doesn't >> send the same arp response out of

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-08 Thread Phil Mayers
On 06/08/2013 08:35 AM, Gavin Henry wrote: your email to /etc/aliases. We found that the Linux kernel doesn't send the same arp response out of the same interface. For example, one interface was a public IP and one was a private IP. The kernel would send a "I'm on MAC blah" for the private IP ou

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-08 Thread Gavin Henry
Hi John, We (SureVoIP) have seen this on some of our hosted SIP servers which run on Linux with multiple interfaces. This was connected to a Cisco switch though. If the SBC is on linux then install arpwatch and add your email to /etc/aliases. We found that the Linux kernel doesn't send the same ar

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-07 Thread John Neiberger
Here is another example of the same type of thing. In this case, a MAC address appears to be jumping from one four-port card to another on the same switch. Port 5 is connected to one NIC, while port 8 is on another four-port NIC and should never, ever use the MAC address we're learning on port 5. D

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-07 Thread John Neiberger
I just checked and we do not have spanning tree enabled on this switch or its partner. We have two switches with a 10-gig link between them. Each switch is connected to a different upstream router. The device in question is a session border controller for VoIP. It is a chassis with multiple four-po

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-07 Thread Harold 'Buz' Dale
Are you running spanning tree ? Sent from my iPhone On Jun 7, 2013, at 18:37, "Gavin Henry" wrote: > Is this a server connected via two ports? > > Sent from my iPad 2 > > On 7 Jun 2013, at 23:12, John Neiberger wrote: > >> Also, another interesting thing about this is that the output of "s

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-07 Thread Gavin Henry
Is this a server connected via two ports? Sent from my iPad 2 On 7 Jun 2013, at 23:12, John Neiberger wrote: > Also, another interesting thing about this is that the output of "show > ethernet mac-learning-log" stops at April 13th. I have no idea why. If a > MAC address were jumping around, we'

Re: [j-nsp] What is this ethernet switching trace telling us?

2013-06-07 Thread John Neiberger
Also, another interesting thing about this is that the output of "show ethernet mac-learning-log" stops at April 13th. I have no idea why. If a MAC address were jumping around, we'd see it in the MAC learning log...if it were up to date. What would cause a Juniper switch to stop logging to the MAC

[j-nsp] What is this ethernet switching trace telling us?

2013-06-07 Thread John Neiberger
We're trying to troubleshoot an odd issue and this log output makes it appear that a MAC address is flipping between interfaces. There are other interfaces involved later in the logs. I'm starting to think this isn't telling us what we think it's telling us. Does this indicate that the MAC address