topic Re: Determining source of IP address in NSX-T in VMware NSX Discussions

Determining source of IP address in NSX-T

knetwerking101 — Mon, 06 Nov 2023 18:11:39 GMT

Hello. We have an NSX-T environment in which we are trying to determine source of broadcast traffic from IP 250.250.254.254. The traffic is captured between two ESXi hosts that have NSX-T edge nodes installed. We have three edge nodes installed in a cluster. Looking at the attached screenshot, the traffic is traversing via a Geneve tunnel between the two NSX-T edge nodes. Could the traffic from 250.250.254.254 be a heartbeat message between the NSX-T edge nodes? Looking at the timestamps in the attached screenshot, there is quite a bit of traffic from 250.250.254.254. Thanks in advance for any comments and insight.

Re: Determining source of IP address in NSX-T

Sreec — Mon, 06 Nov 2023 18:41:57 GMT

Why did you decide to look at this broadcast frame? Why is the source field's class E range there?

Re: Determining source of IP address in NSX-T

knetwerking101 — Mon, 06 Nov 2023 19:52:36 GMT

Thanks for the reply Sreec. We wanted to see what multicast traffic, if any, was traversing the network. So, we initially did a search for IP's within the class d range in the wireshark capture. Then later on, we noticed the 250.250.254.254 address. In regards why the class E address is there, I am trying to determine what device/service is using this address as well. Does anything within the VMWare environment use this address for heartbeat messages etc.? This class E address seems to continually be sending a broadcast. We've recently came into the position of managing and maintaining this network, so trying to put it together in my head.