Switches, Hubs, and Modems
1748237 Members
3750 Online
108759 Solutions
New Discussion юеВ

Re: IPX SA General Query

 
SOLVED
Go to solution
Ronnie Hamilton_1
Frequent Advisor

IPX SA General Query

Hi,

I started having a look at wire Shark recently just running from my PC and it looks like there are a lot of IPX SA General Query packets running round out network. on further investagation it seems that these broadcasts are coming from my HP switches. I was under the impression that I was just running IP on these devices. when I try and do a show IPX the commanad is invallid.

Is this normal or is there any way to check whats happening. All our devices should just have just IP enabled.

thanks
Ronnie
7 REPLIES 7
Jonathan Axford
Trusted Contributor

Re: IPX SA General Query

Hi Ronnie,

Is it definately the switches that are generating the traffic? Is there a possibility that you have some old HP network printers running that could possibly be the cause.

I have seen similar things in a network before, another thing we had was Windows clients that had NWLINK installed.

It is worth checking Printers etc. just to make sure that IPX is disabled if you are not usig it.

Cheers

Jonboy
Where there is a will there is a way...
Mohieddin Kharnoub
Honored Contributor

Re: IPX SA General Query

Hi

I agree with Jonathan, i saw that before, its most probably a client has NWLINK protocol installed.

I think what got you confused is that you saw in Wireshark in the Source field, HewlettP_ (last mac portion), and i think it something made by HP and has this protocol broadcasting all over the network.

Good Luck !!!
Science for Everyone
Ronnie Hamilton_1
Frequent Advisor

Re: IPX SA General Query

Guys,

that could be it, wireshark virgin.

There are a lot of HP printer's floating about and some 98 clients.

Is there any way I can identify these devices from wireshark ?

Ron
Mohieddin Kharnoub
Honored Contributor
Solution

Re: IPX SA General Query

Hi

Use the Wireshark to get the MAC, then use Show mac on the relevant switches to get it.

Good Luck !!!
Science for Everyone
Ronnie Hamilton_1
Frequent Advisor

Re: IPX SA General Query


Yea

thats my problem Im not sure were to find the MAC were the packet orgionates.
I seem to be reading the switch MAC's from the packet ...and when I search for any of these MAC's in PCM it is matching a switch.

?

ROn
Jonathan Axford
Trusted Contributor

Re: IPX SA General Query

Hi Ronnie,

If you have access to any of the printers it is probably worthwhile either using telnet / Http access to the printer or visitng the printer itself to see if the IPX protocol is enabled.

You should be able to see from Wireshark the Source MAC address of any clients that are running NWLINK and use the show arp as suggested... It seems unusual that all of the source addresses should be that of the switch.... Will continue thinking!!!
Where there is a will there is a way...
Ronnie Hamilton_1
Frequent Advisor

Re: IPX SA General Query

Guys,

Just looked in Web Jet Admin and most of the printers have an IPX name and protocol assigned to them,
will further investagate this

cheers for the help

Ron