HP Switch Protocol

[Tony Barrett_2]

I've started to notice quite an extensive amount of traffic coming from our HP switches. We use 2608, 2626, 2650, 2848 and 5308. All are working normally in all other respects. We're not using the absolute latest versions of the firmware, but they are not that old.

Essentially, if I do a network trace from my LAN PC (using Ethereal), I see large amounts of traffic from all switches, which is identified by Ethereal as 'HP Switch Protocol' and 'HP Extended Local-Link Control'. Because I can see the traffic from my switched port, it has to be multicast, as the destination MAC address is not a broadcast one. The traffic has a source MAC of the switch, but all frames have a destination MAC of 09:00:09:00:00:67. Even with the latest release of Ethereal, the DSAP and SSAP types are listed as Unknown (0x0623). We do use CDP here for network mapping, but that is identified seperately as a known protocol. All the switches on the network seem to be doing this periodically.

The decoded part of the packet for the 'HP Switch Protocol' identifies the switch name, MAC, f/w version, device type and IP address, and is listed as version 0x03, type 0x01.

Anyone have any ideas what this traffic is?

[Sergej Gurenko]

It can be some kind of "HP Switch Meshing protocol" messages.
LLDP use other mac addresses for sending announcements.

[Matt Hobbs]

The packets addressed to 09:00:09:00:00:67 are due to the stack management feature on those switches.

Each switch with stacking enabled will send one packet every 60 seconds.

You can disable it by 'no stack' if required.

[Tony Barrett_2]

Thanks Matt, that could make more sense. We have some switches in stacks, and there is a heartbeat used to verify switch connectivity.

I'll verify that the traffic is coming from the switches in stacks only, but is sounds very plausable.

[Matt Hobbs]

Don't forget to assign points to posts that have helped you.

[alyn_1]

I had the same problem and a show stack command showed stacking was enabled, so I am turning it off