behavior while changing vlans

[Martin Joppen]

Hi guys,

if I change a ports vlan from e.g. vlan 3 to vlan 4, does the procurve switch assign the port first to the default vlan and then to vlan 4?

Where may I find such information myself?

I ask this, because I´m interested in the internal behaviour of procurve switches and because we have an error, which affects the default vlan. My colleague just changed a ports vlan.

I am using hp procurve 2610 series.

Best regards,

Martin

[Mohammed Faiz]

Hi,

I don't believe that is the case and I've never experienced anything to suggest that this happens.
In fact we have a few systems that automatically change vlans on our switches when a device connects and we don't see this behaviour there.
What exactly is the error you are seeing when changing vlans?

[Martin Joppen]

Hi and thanks for the quick response,

the notification is:

ip: DEFAULT_VLAN: icmp: Unsolicited Echo Reply from 10.1.x.x

In my opinion this happened while changing the vlan, because there was no other event and we never had an error like this.

That´s why I am asking for the internal behavior, because the default vlan wasn´t included in any action.

Best regards,

Martin

[Mohammed Faiz]

The log reference to the default VLAN is just pointing to the VLAN that the switch has this IP on.
In other words if you are routing to VLAN 1 and your swtich has an IP on VLAN 1 then that message does not necessarily mean that a port was moved to/from VLAN 1.

Do you know what the device with IP 10.1.x.x is?

[Martin Joppen]

The device was a Win95-PC in 192.168.4.0/24 net (Vlan4) and it is now a Linux-Thinclient in the 10.1.9.0/24(vlan 1009) net.

[Mohammed Faiz]

Ok, and are you routing to the network for VLAN 1 on that switch? i.e. can you reach it from other subnets or external hosts?
I don't think the message is related to the change of VLAN.
The behaviour it indicates is that of some rougue traffic, potentially malware/virus related so the reported IP (10.1.x.x) may well be spoofed.
If you're seeing that log message a lot you could do a network capture on that switch to locate the source MAC address of the device sending the ICMP packet.

[Martin Joppen]

Hi,

Vlan 1 is not used for productivity. There is no ip-address assigned. The IP/Port where the message came from is the new adress of the new device in vlan 1009 replacing the windows95 device in vlan 4 on the same port.

The message only appeared once, after the new device was attached.

Best Regards,

Martin

[Mohammed Faiz]

Now that is strange, it could be a software bug on the logging, I'll try and simulate it on one of our 2610's and let you know what I get.
I assume your switch has an IP on one of it's VLANs?

[Martin Joppen]

Hi,

at this time it had an ip-address in 192.168.9.x and in the mgmt-vlan. I never had such behavior/message before and after this one. So it is strange, that the default-vlan appeared. That´s why I wanted to know if the port is moved form the "old"-vlan to the default-vlan and then to the "new"-vlan.

Thank you very much for the work you put in here.

Greetings,

Martin

[Martin Joppen]

Hi,

it was of course 10.1.9.x vlan 1009 where it had an ip-address at this time. I removed it afterwards, because we only want to have the switches in mgmt-vlan.

Greetings,

Martin