topic Re: HP Switch Protocol in Switches, Hubs, and Modems

HP Switch Protocol

Tony Barrett_2 — Mon, 06 Mar 2006 05:15:39 GMT

I've started to notice quite an extensive amount of traffic coming from our HP switches. We use 2608, 2626, 2650, 2848 and 5308. All are working normally in all other respects. We're not using the absolute latest versions of the firmware, but they are not that old.

Essentially, if I do a network trace from my LAN PC (using Ethereal), I see large amounts of traffic from all switches, which is identified by Ethereal as 'HP Switch Protocol' and 'HP Extended Local-Link Control'. Because I can see the traffic from my switched port, it has to be multicast, as the destination MAC address is not a broadcast one. The traffic has a source MAC of the switch, but all frames have a destination MAC of 09:00:09:00:00:67. Even with the latest release of Ethereal, the DSAP and SSAP types are listed as Unknown (0x0623). We do use CDP here for network mapping, but that is identified seperately as a known protocol. All the switches on the network seem to be doing this periodically.

The decoded part of the packet for the 'HP Switch Protocol' identifies the switch name, MAC, f/w version, device type and IP address, and is listed as version 0x03, type 0x01.

Anyone have any ideas what this traffic is?

Re: HP Switch Protocol

Sergej Gurenko — Mon, 06 Mar 2006 08:00:54 GMT

It can be some kind of "HP Switch Meshing protocol" messages.
LLDP use other mac addresses for sending announcements.

Re: HP Switch Protocol

Matt Hobbs — Mon, 06 Mar 2006 19:56:36 GMT

The packets addressed to 09:00:09:00:00:67 are due to the stack management feature on those switches.

Each switch with stacking enabled will send one packet every 60 seconds.

You can disable it by 'no stack' if required.

Re: HP Switch Protocol

Tony Barrett_2 — Tue, 07 Mar 2006 04:44:22 GMT

Thanks Matt, that could make more sense. We have some switches in stacks, and there is a heartbeat used to verify switch connectivity.

I'll verify that the traffic is coming from the switches in stacks only, but is sounds very plausable.

Re: HP Switch Protocol

Matt Hobbs — Tue, 07 Mar 2006 20:12:37 GMT

Don't forget to assign points to posts that have helped you.

Re: HP Switch Protocol

alyn_1 — Tue, 23 Sep 2008 08:49:12 GMT

I had the same problem and a show stack command showed stacking was enabled, so I am turning it off