no devices connected but still traffic on vlan ?

noplan

@stephenw10 said in no devices connected but still traffic on vlan ?:

packet capture

oh yeah
thanks for the hint !

done that ... its a mini "managed" 8p switch
doin this ...

seems kind of that there is VLAN1 "the default" turned on on this interface

wohaaa sounds fun gonna look into this !

br & thanks NP

stephenw10

Ah fun. Yes a I have a TP-Link switch that does that, leaks broadcast traffic between VLANs.
No way to disable VLAN1 on all ports on that device.
I no longer use it for anything but an unmanaged switch.

Steve

johnpoz

tplink switch? 105e or 108e, yeah they do not allow you to remove vlan 1. There was a firmware "fix" for v3 of the hardware. And it even can be installed on the v2.

But yeah @stephenw10 has the best idea for these switches, don't use it for anything but a dumb switch. Mine has better use - its sitting on my self as a dust collector ;)

Prob wouldn't of been a big deal if they would of came back and said - oh shit, yeah that is not right - upgrade to firmware xyz to fix it.. But took about a year of them saying it was by design that you couldn't remove vlan 1 before they actually fixed it.. And they never back ported it.. Only reason figured out you could actually install the v3 firmware on the v2 is someone here posted you could.

So I would prob just stay clear of their entry level switches for sure.. Other than dumb switch with an IP on it ;)

And their AP do the same sort of nonsense..

JKnott

@stephenw10

I used mine to create a data tap. Since it doesn't use VLAN tags, it's fine

noplan

@johnpoz said in no devices connected but still traffic on vlan ?:

tplink switch? 105e or 108e

yeah here this one is a 108e version 5

hmmm thought the tech-troopers removed vlan1

but maye not on the uplink ;)
gonna check

for low budget projects still solid hardware ...
;)

NP

johnpoz

@noplan said in no devices connected but still traffic on vlan ?:

for low budget projects still solid hardware ...

Not if you can not remove vlan 1 - if not then its POS!! even if was free ;) if the goal is to do vlans..

if your on v5, I would sure hope you can remove vlan 1 - or they are back to be clueless to how vlans work ;)

There is nothing actually wrong with using the default vlan ID, the problem is that they would not let you remove it from ports that you didn't want to have anything to do with the default vlan.

So broadcasts would go to every port from vlan 1 ports.

stephenw10

Yeah if you have the v5 you should be able to remove vlan1 if you have the current firmware.

Mine is v1 (16 port) so I'm SoL.

Steve

noplan

@stephenw10

yeah v5

to remove VLAN1
1st Step

2nd Step

then VLAN 1 is removed from the port

easy cheeeeeeesyyyy ;) as long as the firmware lets u do this ;)

and now the only thing i ve to do is to figure out
how or better what they were thinking when tey configured the uplinks on that switch

why would they tag VLAN-1 on the uplink port ...

oh boy ... this will be fun

stephenw10

@noplan said in no devices connected but still traffic on vlan ?:

oh boy ... this will be fun

johnpoz

@noplan said in no devices connected but still traffic on vlan ?:

why would they tag VLAN-1 on the uplink port ...

Because like I said they don't actually have a clue to how vlans are suppose to work ;)

Why would you trust a company to do anything correctly that wouldn't allow you to remove vlan 1 from a port? If you were assigning the port to a different vlan?

noplan

@johnpoz

I m crawlin through a lousy lazzy sloppy documentation

With a kind a daisy chain uplink connected switches terminating in 1 port of pfsense

As far as I can see this through

They got some untouched switches somewhere
That are on vlan 1 and r uplinking to this sweet daisy chain of tp Links

Oh yeah fun... On a remote day!!

stephenw10

Mmm, VLAN1 should never be tagged outside a switch IMO. But that is just an opinion, technically vlan 1 is just as valid as any other tag.
It's really only because of misbehaving switches and bad documentation that VLAN 1 needs to be avoided. It still amazes me how many times we see people who think that tagged VLAN1 is the same as untagged.

Steve

noplan

@stephenw10

Yep it doesn't matter if it's tag 1777 or 1
As long as all of the switches know how to deal with it.

The more and more we do this kind of work the more we find that kind of configs

Off topic a couple of days we fond a pfsBox
With Lan rule 1st line allow any2any then followed by 90 other rules ;) sweet?

stephenw10

Was it labelled 'test - must delete' ?

Bonus points if it was on an interface group covering all the other interfaces including WAN!

I've seen things man!

Steve

johnpoz

Yeah you can tag vlan 1 if your equipment supports such a thing.. Its not a common or recommended thing to do... but sure you might have need to do such a thing at some point.

But vlan 1 wouldn't and shouldn't also be untagged - which couldn't happen. There should either be no untagged or native vlans on that port, or it needs to be something other than 1 if your going to tag 1, etc.

JKnott

@stephenw10 said in no devices connected but still traffic on vlan ?:

Mmm, VLAN1 should never be tagged outside a switch IMO. But that is just an opinion, technically vlan 1 is just as valid as any other tag.
It's really only because of misbehaving switches and bad documentation that VLAN 1 needs to be avoided. It still amazes me how many times we see people who think that tagged VLAN1 is the same as untagged.

I have noticed something curious with my Cisco SG 200-08 switch. When using port mirroring, it appears to use VLAN 1 tags on outgoing data from the switch port, but not incoming. It really had me confused, until I figured out where the VLAN tag was coming from. I assume that's an artifact of the port mirroring.

noplan

@johnpoz

none of this equipment here needs or requires a VLAN1

this is ~~afaik~~ what i see here, they use VLAN to seperate offices / teams whatever
with tPLink switches (from 8 tp 16 port and from v1 - v5)

what i see here is that the whole "original" LAN (LAN interface on the pfsBox) leads to ports on the switches as tagged / untagged with VLAN1 (sometimes default setting sometimes confiurated as VLAN1)

so what i m guessing is that these folkes done some things with their equipment and were pretty lazzy as long as it worked and tagged vlan1 all around to get access to the gui of a TPLINK :)

gonna figure this out tomorrow after a nice chat with these hardware / network folks on site ;)

i ll keep u posted when i killed the broadcast caused by VLAN1 on that interface
brNP

stephenw10

@noplan said in no devices connected but still traffic on vlan ?:

what i see here is that the whole "original" LAN (LAN interface on the pfsBox) leads to ports on the switches as tagged / untagged with VLAN1 (sometimes default setting sometimes confiurated as VLAN1)

Mmm, that sounds exactly like the work of someone who didn't understand the difference between tagged vlan1 and untagged.

johnpoz

hehehe - my point exactly.. From the stuff I have seen their entry level do, and responses from their support.. I just don't think they get vlans at a basic concept level even ;)

I would just stay away from that whole line, if what you want is vlan support.. That works as it should.. Not like there are not other options at the same price point.

You throw in equipment that doesn't do vlan correctly, then with people trying to use said equipment that also don't actually understand vlans and you end up with a great big steaming pile of you know what ;)

JKnott

@johnpoz said in no devices connected but still traffic on vlan ?:

I just don't think they get vlans at a basic concept level even ;)

That's the impression I got when I was talking to their "support" people about my AP problem. They didn't understand that a VLAN is supposed to behave as though it was a physically separate LAN. When I talked to 2nd level support, he knew that, but there was still no fix forthcoming, though apparently it has been resolved on later versions.

It's often "fun" trying to get past 1st level support, when it's obvious they're clueless. When I call my ISP, I usually immediately ask to speak to 2nd level, as I know I'd likely be wasting my time with 1st level.