Re: Bogon IPs traffic only seen by netflow, confined within a VLAN only
[email protected] 10 Apr 2006 13:57:07 -0000
| Newsgroups | gmane.comp.security.incidents |
|---|---|
| Message-ID | <[email protected]> |
I have seen something simular. We were seeing "bad ARP request" messaged logged on our Cisco CSS 11050 switches when one of our admins plugged a "dumb" switch into the same Cisco 4006 switch as the CSS. Thankfully for us we were able to find the last change in order to find the source of the anomalous traffic.