NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
GS308EP sends management traffic outside configured Management VLAN
Hello, I would like to report a possible VLAN isolation issue with my GS308EP. Environment Device: NETGEAR GS308EP Firmware: V2.0.0.11 (latest as of writing) Configuration: The uplink port ...
ARP, NTP, DNS, UPnP/SSDP, and other management-plane traffic
Just want to point out that ARP, DNS, and UPnP/SSDP are control-plane, and not management-plane.
That said, if 192.168.8.18 is only part of VLAN 8, then ARP "who-has" packets should only be broadcast to the devices in that VLAN.
Thanks for the clarification.
Yes, 192.168.8.18 is the IP address assigned to the switch and is configured only for VLAN 8.
I observed that the switch sends ARP requests with 192.168.8.18 as the sender across configured VLANs, for example:
17:34:17.716727 28:94:01:XX:XX:XX > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP (0x0806), Request who-has 192.168.8.1 tell 192.168.8.18, length 46
17:34:17.717436 28:94:01:XX:XX:XX > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 8, p 0, ethertype ARP (0x0806), Request who-has 192.168.8.1 tell 192.168.8.18, length 46
17:34:17.717470 b4:96:91:XX:XX:XX > 28:94:01:XX:XX:XX, ethertype 802.1Q (0x8100), length 46: vlan 8, p 0, ethertype ARP (0x0806), Reply 192.168.8.1 is-at b4:96:91:XX:XX:XX, length 28
17:34:17.718168 28:94:01:XX:XX:XX > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 9, p 0, ethertype ARP (0x0806), Request who-has 192.168.8.1 tell 192.168.8.18, length 46
17:34:17.718937 28:94:01:XX:XX:XX > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 16, p 0, ethertype ARP (0x0806), Request who-has 192.168.8.1 tell 192.168.8.18, length 46
I believe these ARP requests should only be present on VLAN 8.
I also observe other traffic generated by the switch itself, such as DNS, NTP, and SSDP, being transmitted with VLAN tags other than VLAN 8.
17:37:49.884570 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 19, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48
17:37:55.889576 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 25, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48
17:38:00.893427 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 19, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48
17:38:05.897160 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 24, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48
17:38:11.902082 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 19, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48
I believe these ARP requests should only be present on VLAN 8.
Correct.
I also observe other traffic generated by the switch itself, such as DNS, NTP, and SSDP, being transmitted with VLAN tags other than VLAN 8.
Corrrect again.
Admit, I was impressed to find the Management VLAN config option poping-up on these recent switch firmware updates. But never had any effective project - had aquired a GS308EP and a GS305EP - and I -think- I have observed the similar issues as you correctly and report in a very professional manner.
I'll try to find some old contacts in NTGR to escalate. Mabye fellow LaurentMa can push this thread to the relevant product managers and QA.
-Kurt
Switzerland
Thank you very much for looking into this and for trying to escalate it.
I really appreciate your help. I would be happy to provide any additional packet captures or configuration details if needed.
I observed that the switch sends ARP requests with 192.168.8.18 as the sender across configured VLANs,
Are you seeing this behavior on devices that are not on VLAN 8?
Check the captured data details, clearly showing frames for VLAN 1 9, 16, 19, 24, and 25.
Check the captured data details, clearly showing frames for VLAN 1 9, 16, 19, 24, and 25.
Yes, but those frames were all sent from the management PC on VLAN 8.
I was asking if broadcast frames sent from other VLANs (not the management one) were also going to other broadcast domains.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
