show ip traffic not a gateway

[Marvin de Haas]

Dear Sir/ Madam,

Recently I was investigating IP connectivity disconnects between a layer 2 switch (WS-C2960G-8TC-L with IOS 12.2(35)SE5 and default gateway internet router. The links are not showing any error messages (CRC, collisions etc).

The only error I encountered was "not a gateway" using the sh ip traffic command.

IP statistics:
  Rcvd:  59771670 total, 71136 local destination
         0 format errors, 0 checksum errors, 0 bad hop count
         0 unknown protocol, 59700534 not a gateway
         0 security failures, 0 bad options, 366 with options
  Opts:  0 end, 0 nop, 0 basic security, 0 loose source route
         0 timestamp, 0 extended security, 0 record route
         0 stream ID, 0 strict source route, 366 alert, 0 cipso, 0 ump
         0 other
  Frags: 0 reassembled, 0 timeouts, 0 couldn't reassemble
         0 fragmented, 0 couldn't fragment
  Bcast: 3 received, 21 sent
  Mcast: 0 received, 0 sent
  Sent:  50681 generated, 0 forwarded
  Drop:  17940 encapsulation failed, 0 unresolved, 0 no adjacency
         0 no route, 0 unicast RPF, 0 forced drop
         0 options denied, 0 source IP address zero

The complete output of both switches is attached to this post.

Does anyone have a explenation for these entries?

Best regards,

[Dennis Leon]

Wim,

Is this switch configured as Layer 3 Switch or it is just doing "bridging" between the ISP and your LAN; could you attach the config of the switch?

D.

[Marvin de Haas]

Hi Dennis,

Thanks for your reply. The swithes are configured as layer 2 devices and no layer 3 routing is enabled.

I removed the enable password and IP address information from the attached configuration files.

The configuration is very basic.

Do you have an idea what is causing the no gateway counters to constantly increase?

[PETER EIJSBERG]

The counters show the IP traffic that was received by the switch: out of 59771670 IP packets, 71136 were destined for the switch itself, while 59700534 packets had a destination IP address that was not the switch itself. Since the switch is not doing any Layer 3 (it is not routing traffic), it drops those 59700534 packets because it is not a gateway (= router).

So I think there's nothing wrong with the switch itself. But some system is sending traffic to it (or using Layer 2 broadcast for an IP unicast) thinking that it is the gateway on that LAN. If you really want to know what is causing this, capture the traffic on that VLAN with Wireshark and look for traffic that is destined to the MAC address of the switch (not the IP address). That might show you where it is coming from.

Peter

[Marvin de Haas]

Hi Peter,

Thanks for your brief explanation.

I think your totally right that some device is thinking that this layer 2 switch is the default gateway of this segment.

Soon I am going to capture all the traffic in that VLAN and investigate what device is communicating towards it.

I will let you know soon.

Best regards,