MX84 - Tracking some Event Log traffic

[Pappaslim]

Been using MX84 Meraki (Adv License) since beginning of June and love it. 

Seeing lots of these entries in the Event Log:

Neither subnets are part of our network. We have checked every cable connected to our switches. 

any help would be great.

thanks

Pappaslim

[dhatcher]

Checked to see if anyone has a rogue DHCP server plugged in (usually in the form of a home wireless router at someone's desk)?

[jdsilva]

It could be a client that's connecting to your network but still thinks it has a valid lease from the network is was previously connected to. Mobile devices do this from time to time, but quickly figure out they don't have connectivity with their current IP and fall back to DHCP to get a new one.

[AjitKumar · Accepted solution]

Hi Pappaslim,

The MAC address search suggests the vendor as Seagate Cloud Systems

Kindly check the following Url

https://aruljohn.com/mac/0050CC

Are you having any Seagate NAS / Any other similar device in your network?

You may consider rechecking the Interface configuration there.

You may also refer the following Url for more information on VLAN Mismatch Events.

https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/VLAN_Mismatch_Alerts_for_Meraki_Swit...

https://community.meraki.com/t5/Security-SD-WAN/Source-IP-and-or-VLAN-mismatch-Internet-connection-i...

[PhilipDAth]

@jdsilva  and @AjitKumar give very probably causes.

[Pappaslim]

I was not aware we did but after installing the Advanced IP Scanner I have this:

Which is our  Dell Compellent Storage Center (SC220). The MAC addresses are in the same range AND the Manufacturer.

I have checked and management app for the SC220 and do not see any of the IP interfaces with the MAC addresses listed on the firewall.