I've started to notice quite an extensive amount of traffic coming from our HP switches. We use 2608, 2626, 2650, 2848 and 5308. All are working normally in all other respects. We're not using the absolute latest versions of the firmware, but they are not that old.
Essentially, if I do a network trace from my LAN PC (using Ethereal), I see large amounts of traffic from all switches, which is identified by Ethereal as 'HP Switch Protocol' and 'HP Extended Local-Link Control'. Because I can see the traffic from my switched port, it has to be multicast, as the destination MAC address is not a broadcast one. The traffic has a source MAC of the switch, but all frames have a destination MAC of 09:00:09:00:00:67. Even with the latest release of Ethereal, the DSAP and SSAP types are listed as Unknown (0x0623). We do use CDP here for network mapping, but that is identified seperately as a known protocol. All the switches on the network seem to be doing this periodically.
The decoded part of the packet for the 'HP Switch Protocol' identifies the switch name, MAC, f/w version, device type and IP address, and is listed as version 0x03, type 0x01.
