no devices connected but still traffic on vlan ?



  • no device on this VLAN is connected ;)

    any ideas why i can

    see this

    90659ca6-f4b0-409c-8d55-a14eec33cb8b-grafik.png

    but see nothing here ...

    d877bc87-8357-4ece-a8ff-8cebb3773055-grafik.png

    br NP


  • Netgate Administrator

    Run a packet capture on it, see what's there.

    At 60bps though it's probably just something ARPing or maybe some STP traffic.

    Steve



  • @stephenw10 said in no devices connected but still traffic on vlan ?:

    packet capture

    oh yeah
    thanks for the hint !

    done that ... its a mini "managed" 8p switch
    doin this ...
    3c4bc5cb-d2b2-4d8f-976d-21339ff3554d-grafik.png

    seems kind of that there is VLAN1 "the default" turned on on this interface

    wohaaa sounds fun gonna look into this !

    br & thanks NP


  • Netgate Administrator

    Ah fun. Yes a I have a TP-Link switch that does that, leaks broadcast traffic between VLANs.
    No way to disable VLAN1 on all ports on that device.
    I no longer use it for anything but an unmanaged switch.

    Steve


  • LAYER 8 Global Moderator

    tplink switch? 105e or 108e, yeah they do not allow you to remove vlan 1. There was a firmware "fix" for v3 of the hardware. And it even can be installed on the v2.

    But yeah @stephenw10 has the best idea for these switches, don't use it for anything but a dumb switch. Mine has better use - its sitting on my self as a dust collector ;)

    Prob wouldn't of been a big deal if they would of came back and said - oh shit, yeah that is not right - upgrade to firmware xyz to fix it.. But took about a year of them saying it was by design that you couldn't remove vlan 1 before they actually fixed it.. And they never back ported it.. Only reason figured out you could actually install the v3 firmware on the v2 is someone here posted you could.

    So I would prob just stay clear of their entry level switches for sure.. Other than dumb switch with an IP on it ;)

    And their AP do the same sort of nonsense..



  • @stephenw10

    I used mine to create a data tap. Since it doesn't use VLAN tags, it's fine



  • @johnpoz said in no devices connected but still traffic on vlan ?:

    tplink switch? 105e or 108e

    yeah here this one is a 108e version 5

    hmmm thought the tech-troopers removed vlan1

    but maye not on the uplink ;)
    gonna check

    for low budget projects still solid hardware ...
    ;)

    NP


  • LAYER 8 Global Moderator

    @noplan said in no devices connected but still traffic on vlan ?:

    for low budget projects still solid hardware ...

    Not if you can not remove vlan 1 - if not then its POS!! even if was free ;) if the goal is to do vlans..

    if your on v5, I would sure hope you can remove vlan 1 - or they are back to be clueless to how vlans work ;)

    There is nothing actually wrong with using the default vlan ID, the problem is that they would not let you remove it from ports that you didn't want to have anything to do with the default vlan.

    So broadcasts would go to every port from vlan 1 ports.


  • Netgate Administrator

    Yeah if you have the v5 you should be able to remove vlan1 if you have the current firmware.

    Mine is v1 (16 port) so I'm SoL. ๐Ÿ˜‰

    Steve



  • @stephenw10

    yeah v5

    to remove VLAN1
    1st Step
    dd248501-5dbf-47f9-95f8-3cf56043c58c-grafik.png
    13e868f2-b41b-4a1c-8858-98b0068000d7-grafik.png
    f6d5be39-0fa2-47e8-afd9-5b9b7404be6b-grafik.png

    2nd Step
    253c2c49-8673-4e86-ac1f-8718942064d8-grafik.png
    fdc24172-1048-4242-9f95-f3c98d7227b3-grafik.png
    7a4d80d5-9f73-4258-9977-1a52c3618b2d-grafik.png

    then VLAN 1 is removed from the port

    easy cheeeeeeesyyyy ;) as long as the firmware lets u do this ;)

    and now the only thing i ve to do is to figure out
    how or better what they were thinking when tey configured the uplinks on that switch

    why would they tag VLAN-1 on the uplink port ...

    oh boy ... this will be fun


  • Netgate Administrator

    @noplan said in no devices connected but still traffic on vlan ?:

    oh boy ... this will be fun

    ๐Ÿ˜


  • LAYER 8 Global Moderator

    @noplan said in no devices connected but still traffic on vlan ?:

    why would they tag VLAN-1 on the uplink port ...

    Because like I said they don't actually have a clue to how vlans are suppose to work ;)

    Why would you trust a company to do anything correctly that wouldn't allow you to remove vlan 1 from a port? If you were assigning the port to a different vlan?



  • @johnpoz

    I m crawlin through a lousy lazzy sloppy documentation

    With a kind a daisy chain uplink connected switches terminating in 1 port of pfsense

    As far as I can see this through

    They got some untouched switches somewhere
    That are on vlan 1 and r uplinking to this sweet daisy chain of tp Links

    Oh yeah fun... On a remote day!!


  • Netgate Administrator

    Mmm, VLAN1 should never be tagged outside a switch IMO. But that is just an opinion, technically vlan 1 is just as valid as any other tag.
    It's really only because of misbehaving switches and bad documentation that VLAN 1 needs to be avoided. It still amazes me how many times we see people who think that tagged VLAN1 is the same as untagged.

    Steve



  • @stephenw10

    Yep it doesn't matter if it's tag 1777 or 1
    As long as all of the switches know how to deal with it.

    The more and more we do this kind of work the more we find that kind of configs

    Off topic a couple of days we fond a pfsBox
    With Lan rule 1st line allow any2any then followed by 90 other rules ;) sweet?


  • Netgate Administrator

    Was it labelled 'test - must delete' ? ๐Ÿ˜‰

    Bonus points if it was on an interface group covering all the other interfaces including WAN!

    I've seen things man! ๐Ÿ˜ต

    Steve


  • LAYER 8 Global Moderator

    Yeah you can tag vlan 1 if your equipment supports such a thing.. Its not a common or recommended thing to do... but sure you might have need to do such a thing at some point.

    But vlan 1 wouldn't and shouldn't also be untagged - which couldn't happen. There should either be no untagged or native vlans on that port, or it needs to be something other than 1 if your going to tag 1, etc.



  • @stephenw10 said in no devices connected but still traffic on vlan ?:

    Mmm, VLAN1 should never be tagged outside a switch IMO. But that is just an opinion, technically vlan 1 is just as valid as any other tag.
    It's really only because of misbehaving switches and bad documentation that VLAN 1 needs to be avoided. It still amazes me how many times we see people who think that tagged VLAN1 is the same as untagged.

    I have noticed something curious with my Cisco SG 200-08 switch. When using port mirroring, it appears to use VLAN 1 tags on outgoing data from the switch port, but not incoming. It really had me confused, until I figured out where the VLAN tag was coming from. I assume that's an artifact of the port mirroring.



  • @johnpoz

    none of this equipment here needs or requires a VLAN1

    this is afaik what i see here, they use VLAN to seperate offices / teams whatever
    with tPLink switches (from 8 tp 16 port and from v1 - v5)

    what i see here is that the whole "original" LAN (LAN interface on the pfsBox) leads to ports on the switches as tagged / untagged with VLAN1 (sometimes default setting sometimes confiurated as VLAN1)

    so what i m guessing is that these folkes done some things with their equipment and were pretty lazzy as long as it worked and tagged vlan1 all around to get access to the gui of a TPLINK :)

    gonna figure this out tomorrow after a nice chat with these hardware / network folks on site ;)

    i ll keep u posted when i killed the broadcast caused by VLAN1 on that interface
    brNP


  • Netgate Administrator

    @noplan said in no devices connected but still traffic on vlan ?:

    what i see here is that the whole "original" LAN (LAN interface on the pfsBox) leads to ports on the switches as tagged / untagged with VLAN1 (sometimes default setting sometimes confiurated as VLAN1)

    Mmm, that sounds exactly like the work of someone who didn't understand the difference between tagged vlan1 and untagged. ๐Ÿ˜ฌ


  • LAYER 8 Global Moderator

    hehehe - my point exactly.. From the stuff I have seen their entry level do, and responses from their support.. I just don't think they get vlans at a basic concept level even ;)

    I would just stay away from that whole line, if what you want is vlan support.. That works as it should.. Not like there are not other options at the same price point.

    You throw in equipment that doesn't do vlan correctly, then with people trying to use said equipment that also don't actually understand vlans and you end up with a great big steaming pile of you know what ;)



  • @johnpoz said in no devices connected but still traffic on vlan ?:

    I just don't think they get vlans at a basic concept level even ;)

    That's the impression I got when I was talking to their "support" people about my AP problem. They didn't understand that a VLAN is supposed to behave as though it was a physically separate LAN. When I talked to 2nd level support, he knew that, but there was still no fix forthcoming, though apparently it has been resolved on later versions.

    It's often "fun" trying to get past 1st level support, when it's obvious they're clueless. When I call my ISP, I usually immediately ask to speak to 2nd level, as I know I'd likely be wasting my time with 1st level.


  • Netgate Administrator

    I do also have a TP-Link T1700G-28TQ and have nothing but good things to say about it really. It ticks a lot of boxes. I suspect it came from a completely different design team. ๐Ÿ˜‰

    Steve



  • Does your TP-Link have a password overflow issue?



  • @AKEGEC

    Not that I noticed.



  • Same here


Log in to reply