EIGRP mystery

spfister336 · ‎10-23-2018

I have a strange issue going on with EIGRP. We have a central site (Cisco 6509e) and several remote sites (Cisco 4500x VSS pairs) connected via AT&T ASE. All sites seem to have their EIGRP set up correctly. It all works for the most part, but we are seeing some odd issues. A couple of the remote sites are currently empty and have their bandwidth set down to 2mbps. Even though no one is at the site, the incoming traffic is maxed out. A packet capture on the 4500x shows traffic incoming packets that should be going to a completely different site (not really all that much, and it's mainly only one other site). Nothing in any of the topology or routing tables shows why this traffic should be coming to this empty site. Can someone help troubleshoot? I'm not really new to EIGRP but I've never seen something like this.

balaji.bandi · ‎10-23-2018

It good to have some topology and configuration to look.

sample output of the site which you having issue?

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

spfister336 · ‎10-23-2018

eigrp config of the empty site getting flooded:

router eigrp 1
distribute-list 2 out
distribute-list 1 in
network 10.0.0.0
network 192.168.35.0
network 192.168.135.0
passive-interface Vlan35
passive-interface Vlan354
passive-interface Vlan935
passive-interface Vlan135
passive-interface Vlan352
passive-interface Vlan356
passive-interface Vlan358
passive-interface Vlan359
eigrp stub connected summary
no eigrp log-neighbor-changes

eigrp config of site with traffic showing up on empty site:

router eigrp 1
distribute-list 2 out
distribute-list 1 in
network 10.0.0.0
network 192.168.85.0
network 192.168.185.0
passive-interface Vlan85
passive-interface Vlan985
passive-interface Vlan185
passive-interface Vlan285
passive-interface Vlan852
passive-interface Vlan856
passive-interface Vlan858
passive-interface Vlan859
passive-interface Vlan868
eigrp stub connected summary
no eigrp log-neighbor-changes

topology entries from the central site pertaining to this second remote site which is showing up on the empty site:

P 192.168.185.0/24, 1 successors, FD is 3072, serno 48739
via 10.99.89.85 (3072/2816), Vlan89
P 10.185.0.0/16, 1 successors, FD is 3072, serno 48740
via 10.99.89.85 (3072/2816), Vlan89
P 10.185.20.0/22, 1 successors, FD is 2816, serno 57
via Connected, Vlan858
P 192.168.85.0/24, 1 successors, FD is 3072, serno 48741
via 10.99.89.85 (3072/2816), Vlan89
P 10.85.0.0/16, 1 successors, FD is 3072, serno 48742
via 10.99.89.85 (3072/2816), Vlan89

johnd2310 · ‎10-23-2018

Hi,

You said you captured the traffic. What traffic was it and what was source and destination? Was destination a valid network on the remote site?

Thanks

John

**Please rate posts you find helpful**

spfister336 · ‎10-24-2018

I ran a packet capture of all packets for several minutes on the 4500x VSS pair at the remote site. I've done several of them. The destination of many packets was not valid at that site. That's the issue I'm having. The destination is not in use at the site and as far as I can tell, is not being advertised by the site.