Switches, Hubs, and Modems
cancel
Showing results for 
Search instead for 
Did you mean: 

HP Switch Protocol

Tony Barrett_2
Frequent Advisor

HP Switch Protocol

I've started to notice quite an extensive amount of traffic coming from our HP switches. We use 2608, 2626, 2650, 2848 and 5308. All are working normally in all other respects. We're not using the absolute latest versions of the firmware, but they are not that old.

Essentially, if I do a network trace from my LAN PC (using Ethereal), I see large amounts of traffic from all switches, which is identified by Ethereal as 'HP Switch Protocol' and 'HP Extended Local-Link Control'. Because I can see the traffic from my switched port, it has to be multicast, as the destination MAC address is not a broadcast one. The traffic has a source MAC of the switch, but all frames have a destination MAC of 09:00:09:00:00:67. Even with the latest release of Ethereal, the DSAP and SSAP types are listed as Unknown (0x0623). We do use CDP here for network mapping, but that is identified seperately as a known protocol. All the switches on the network seem to be doing this periodically.

The decoded part of the packet for the 'HP Switch Protocol' identifies the switch name, MAC, f/w version, device type and IP address, and is listed as version 0x03, type 0x01.

Anyone have any ideas what this traffic is?
5 REPLIES
Sergej Gurenko
Trusted Contributor

Re: HP Switch Protocol

It can be some kind of "HP Switch Meshing protocol" messages.
LLDP use other mac addresses for sending announcements.
Matt Hobbs
Honored Contributor

Re: HP Switch Protocol

The packets addressed to 09:00:09:00:00:67 are due to the stack management feature on those switches.

Each switch with stacking enabled will send one packet every 60 seconds.

You can disable it by 'no stack' if required.
Tony Barrett_2
Frequent Advisor

Re: HP Switch Protocol

Thanks Matt, that could make more sense. We have some switches in stacks, and there is a heartbeat used to verify switch connectivity.

I'll verify that the traffic is coming from the switches in stacks only, but is sounds very plausable.
Matt Hobbs
Honored Contributor

Re: HP Switch Protocol

Don't forget to assign points to posts that have helped you.
alyn_1
Occasional Visitor

Re: HP Switch Protocol

I had the same problem and a show stack command showed stacking was enabled, so I am turning it off