[rescue] What is this traffic?

[Carl R. Friend]

On 10/29/2015 07:45 AM, microcode at zoho.com wrote:

> Is there any way to see what the traffic between the router and the switch
> is without extra equipment? Does anybody have any idea what this could be?

    Since you're dealing with switches (likely both in the router and
the one that connects your internal network together) you're not going
to see any of that traffic unless you can mirror a port one either one
of the devices.  If there's no way to do that, then the only way you'll
be able to see it is to put a *hub* in between the router and the switch
and then sniff another port on the hub.

    My guess is that you've got some sort of spanning-tree protocol
that's somehow creating a lot more traffic than it should.  If you
are *never* going to plug another device into the switch in the router
try disabling BPDUs (or somesuch) on the internal switch to see if it
makes a difference.

    Cheers!

-- 
+------------------------------------------------+---------------------+
| Carl Richard Friend (UNIX Sysadmin)            | Boylston            |
| Minicomputer Collector / Enthusiast            | Massachusetts, USA  |
| mailto:crfriend at rcn.com                        +---------------------+
| http://users.rcn.com/crfriend/museum           | ICBM: 42:20N 71:43W |
+------------------------------------------------+---------------------+