Switches, Hubs, and Modems
cancel
Showing results for 
Search instead for 
Did you mean: 

Top 5 View in PCM+ misreporting destination

Les Ligetfalvy
Esteemed Contributor

Top 5 View in PCM+ misreporting destination

I have a port on a Procurve 5308xl that is on my business network connected to my WAN router and I monitor the Top 5 View "Connections" on that port in PCM+. The WAN router in turn connects to the internet firewall. My 5308 is also connected on another port to another firewall used to isolate our process contol network from the business network. The switch is in a mesh and deploys no routing at all. The process control firewall and the WAN router are the only routers.

I have noticed on a particular conversation that PCM+ misreports the destination IP. The source IP is a NATted IP in the same subnet as the switch. The reported destination IP is also in the same subnet, therefore the traffic should never appear on the router's port but obviously it does. When I look at the MAC address for the misreported destination, it does not show up on that port.

At first glance, I jumped to the conclusion, that the IP was being spoofed but quickly ruled it out. The true destination was in fact on the other end of the router. In fact the true IP was from a VPN connection on the internet the would have been uncapsulated at the internet firewall/router.

What puzzles me is why PCM+ would misreport the true IP. Is this a PCM+ bug or a feature?
2 REPLIES
Les Ligetfalvy
Esteemed Contributor

Re: Top 5 View in PCM+ misreporting destination

DOH!
Never mind... I must be dyslexic...

My subnet is 10.198.0.0 and 10.198.50.z are workstations.

The destination reported was 10.189.50.z and not 10.198.50.z but in my mind's eye, that is not what I saw.
Les Ligetfalvy
Esteemed Contributor

Re: Top 5 View in PCM+ misreporting destination

Closed