High volume of unexpected ICMP traffic from Procurve switches

[Paul Woolnough]

Hi All,

We have a medium sized LAN campus with Hp Procurve Provision switches (3500, 5400, 8200's - running either K.14.47 or K.14.60) which are centrally managed by PCM+ (B.02.322).

We are seeing a high volume of ICMP ping requests to IP addresses which are not on our network - 10.198.20.1, 10.198.51.1, 10.19.21.1, 10.19.41.1 (etc etc), as there is no route on the network for these they are going through to our internet firewall. There is in the region of 80Mb of traffic per day from maybe 20 switches - Quite a lot!

I have set a number of these switches up myself and have no idea what or why these devices are pinging these unknown addresses so frequently (raises obvious questions about what else they are pinging). There is nothing in the running config for these IP addresses and they are setup as basic L2 switches.

I can only assume that PCM+ is doing something as the devices are being managed by it, but again there is nothing obvious set up.

I could setup a few blackhole routes but quite frankly I shouldn't have to and would like to get to the bottom of this. Any thoughts or feedback would be very welcome!

Paul Woolnough - CCNP, CCDP
ICT Infrastructure Engineer - Networks
University Campus Suffolk

[Helper]

Hi,

You are talking about the destination address, but what are the source address ?

Maybe, virus, inventory tool, etc.

Bye.