How to identify vlan 0 traffic

[olly ahmed]

Our SOC team investigate and informed that they are getting hit from a host on vlan 0. But in cisco switches there is not vlan 0. Now how can we identify the host from switch end ? Can anyone help on this to identify the host.

[Harsha A.]

Check if VLAN 0 priority tagging is enabled on any of the interfaces. 

Is there an IP associated with this host ?

If it is, then do an arp and see what is the MAC address.

Then check your mac address table and identify which interface is the host connected to.

Check the interface configuration and most likely it should be using VLAN 0 priority tagging.

-Harsha