HP PS1810-8G and HP C7280 Printer Issue with Unknown UDP Packet Broadcasts

[drshock]

I am hoping someone might recognize this situation and have some insight.     We recently added a PS1810-8G, running the latest PS.2.07 firmware, as a new switch.   It is the only change in our network in the last four months.

Ever since we introduced it, an HP printer used for receiving FAXes three floors down gets knocked offline at 7AM and 7PM every single day.   Disconnect the new HP switch, this behavior stops.

Reviewing the logs of our network edgerouter on a different floor, we see further evidence of this switch as the root cause by this example syslog entry matching the times (the address is the assigned IPv4 LAN address of our PS1810-8G):

2016-07-15 06:59:25 miniupnpd  Unknown udp packet received from 192.168.2.102:1024

The HP C7280 printer will log a critical error on its local logfile at this same incident time:

575 	69666 	Firmware Error

So we have conclusively identified that the cause of the printers behavior is this periodic unknown UDP broadcast from the PS1810-8G.  Both by process of elimination, and by correlating the time of the events with the syslog information.    We also think it's very likely the HP printer firmware has a defect and should not be reacting this way, but the device is long out of service.  

We have turned on debug level syslogging with the PS1810-8G, but there is nothing in the range of times when these events are happening to point to what is the switch is doing at those times.  So we are just looking for technical information on what we could disable on the switch to stop these particular UDP broadcasts the switch is doing.

We tried turning off auto server discovery - No effect

We tried turning off LLDP - No effect

What other firmware settings trigger the switch to perform a regularly scheduled UDP broadcast that we coud experiment with to alleviate this situation?

[Vince-Whirlwind]

Try enabling IGMP to see if you can use to filter out these packets.

[drshock]

No support for that feature.

[Vince-Whirlwind]

What else could it be....STP? Can you try excluding the switchports the printers are on from BPDUs being sent?

Although, from what you are saying, it only happens every 12 hours - what could that be? NTP?
It would be good if you could capture the packet and see which port it is addressed *to*... the "1024" in the log looks more like the source port.

[drshock]

Thanks, I finally got a chance to write a rule to syslog out any UDP traffic from the HP switches' DHCP IP as the source for a few days.

So what the HP PS1810-8G is sending out looks like a group of 4 SSDP packets when this problem occurs.

They are going out to multicast IP 239.255.255.250, source port 1024, destination port 1900, UDP protocol, multicast mac of 01:00:5e:7f:ff:fa.   The source address is the DHCP IP for the HP PS1810-8G switch.

The switch sends out two of these packets at length 112, bracketed by two of length 32.  Total of four multicast UDP packets.   This behavior happens every 12 hours.

No settings in the firmware for the PS1810-8G jump out as SSDP, or even UPnP related.   Just for grins I tried disabling SNTP, no change in behavior.

The switch that the printer is on a few floors away is managed but a lower end smart type, no per port BPDU settings though it does support RSTP.   But I went ahead and disabled RSTP on the one switch, no change in behavior.   Printer still knocked offline.

Looks like I'll have to just factory reset and try bringing the switch back up one setting at a time over several days and try and isolate where this behavior is originating from.

[Vince-Whirlwind]

This is where having a switch that supports multicast would be good.

I'm thinking - are you sure the switch is responsible? It's probably more likely coming from a network device like a PC or something.

Anyway, this is one reason I like to have PCs and printers on different VLANs. How hard would it be to create a printer VLAN and migrate your printers to that?
(In fact, I normally don't migrate printers to a new VLAN, I tend to find it's easier to migrate all PCs to a "normal" VLAN, leaving all the dodgy stuff on the "Legacy" VLAN.).

[Vince-Whirlwind]

Another thing - I don't manage Windows desktops, but I imagine with Group Poliucy (or whatever it's called these days) you could very easily turn off the uPnP service on all the PCs...?

[drshock]

Yes, we are absolutely sure it is the switch.  As detailed in the OP, and well as simply removing it from the network the problem resolves.  It may be that the switch is responding to something else SSDP related in the network but then the destination port should be 5000 if so.

A VLAN swizzle is one of the thoughts I had if it was not simply a firmware toggle.

Interesting problem, will update the post if we ever figure out how to change the behavior.