For those of you who have read my past articles, I have said countless times that you should "Know your tools". Over the years, I find a lot of examples of this simple statement. Funny thing is how many times people just shrug their shoulders and say "oh well"...
A few weeks ago, while troubleshooting, I noticed something odd. There were multiple mac/ip entries for individual switch ports.
I posted this on social media and received a lot of interest in what the issue might be, most people where more interested in the methodology I use to figure out what the issue is.
Methodology:
- Verify that these switch ports aren't misconfigured. Nope, all ports have simple , single vlan configurations.
- Confirm that these ports don't have switches, ip phones with ethernet pass-thru ports, access points or any other multi interfaced devices. Nope, these are regular desktop computers.
- Are these real online devices? Maybe these are stale entries. A simple ping proved that they are all real and on online.
- Do these MAC addresses appear on other ports. Yes, the same MAC is on other ports.
I caught myself getting deep in the weeds and took a step back and wondered if I saw the same anomaly using the web interface on the switch itself.
Surprise.. The switch reported only one MAC/ip per port!
So the management station wasn't updating. I found out that these computers were moved over a week ago, so that should be plenty of time for the management system to update the tables.