NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
GS308EP sends management traffic outside configured Management VLAN
Hello, I would like to report a possible VLAN isolation issue with my GS308EP. Environment Device: NETGEAR GS308EP Firmware: V2.0.0.11 (latest as of writing) Configuration: The uplink port ...
Thanks for the clarification.
Yes, 192.168.8.18 is the IP address assigned to the switch and is configured only for VLAN 8.
I observed that the switch sends ARP requests with 192.168.8.18 as the sender across configured VLANs, for example:
17:34:17.716727 28:94:01:XX:XX:XX > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP (0x0806), Request who-has 192.168.8.1 tell 192.168.8.18, length 46
17:34:17.717436 28:94:01:XX:XX:XX > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 8, p 0, ethertype ARP (0x0806), Request who-has 192.168.8.1 tell 192.168.8.18, length 46
17:34:17.717470 b4:96:91:XX:XX:XX > 28:94:01:XX:XX:XX, ethertype 802.1Q (0x8100), length 46: vlan 8, p 0, ethertype ARP (0x0806), Reply 192.168.8.1 is-at b4:96:91:XX:XX:XX, length 28
17:34:17.718168 28:94:01:XX:XX:XX > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 9, p 0, ethertype ARP (0x0806), Request who-has 192.168.8.1 tell 192.168.8.18, length 46
17:34:17.718937 28:94:01:XX:XX:XX > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 16, p 0, ethertype ARP (0x0806), Request who-has 192.168.8.1 tell 192.168.8.18, length 46
I believe these ARP requests should only be present on VLAN 8.
I also observe other traffic generated by the switch itself, such as DNS, NTP, and SSDP, being transmitted with VLAN tags other than VLAN 8.
17:37:49.884570 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 19, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48
17:37:55.889576 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 25, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48
17:38:00.893427 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 19, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48
17:38:05.897160 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 24, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48
17:38:11.902082 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 19, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48
I observed that the switch sends ARP requests with 192.168.8.18 as the sender across configured VLANs,
Are you seeing this behavior on devices that are not on VLAN 8?
Check the captured data details, clearly showing frames for VLAN 1 9, 16, 19, 24, and 25.
Check the captured data details, clearly showing frames for VLAN 1 9, 16, 19, 24, and 25.
Yes, but those frames were all sent from the management PC on VLAN 8.
I was asking if broadcast frames sent from other VLANs (not the management one) were also going to other broadcast domains.
Those frames were not sent from a management PC on VLAN 8. They were generated by the GS308EP itself.
GS308EP has MAC address 28:94:01:XX:XX:XX and IP address 192.168.8.18. (28:94:01 is an OUI assigned to NETGEAR.)
The first ARP capture above shows that GS308EP sends broadcast who-has requests to find its default gateway, 192.168.8.1, using 192.168.8.18 as the sender address on all configured VLANs. Then, as expected, 192.168.8.1 (b4:96:91:XX:XX:XX) responds only on VLAN 8.
So what I am observing is that the switch itself sends ARP requests sourced from its IP management address on VLANs other than its configured management VLAN.
My report is about traffic generated by the switch itself. I have also confirmed that a broadcast ARP request sent by a host on VLAN 24 is not leaked to VLAN 9, 16, or 32.
GS308EP System Info showing the switch IP address (192.168.8.18) and default gateway (192.168.8.1).
GS308EP VLAN configuration showing Management VLAN ID 8.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
