HP 4108GL Switch Activity

[Sean_57]

We have an HP 4108GL switch, and the port led lights are constantly going on this, even at 3 in the morning when users are not even on the network. Is this just the switch continuing to update it's table? The performance of the network is actually excellent, but just want to be sure it's not leading to something.

[Ron Kinner]

If you run STP then there is a packet sent every 2 seconds. That's probably what you see.

Some operating systems like Windows are very chatty. Lots of broadcasts even when no one is doing anything.

If you have routers on the network they could be sending out cdp, rip, ospf, eigrp etc updates. Some PCs may also try to do rip or ospf.

Some PCs constantly send out broadcasts looking for some nonexistent master PC controller. Compaq is a good example. 2301 is their favorite port.

HPUX 11.0 sends out a ping periodically to the default gateway to see if it's still alive.

I have even seen a database package which sent out broadcasts for some strange reason.

If it worries you get a sniffer like tcpdump or even better an intrusion detector like snort:
http://www.snort.org/

And see what is really going on.

Ron

[Sean_57]

Ron:

The response and assistance is appreciated. I'll take a look into snort and see what I may find out.

Sean