9

I have a HP 1810-8G (J9802A) 8-port managed switch (according to its labels). I bought this one because of its capability of mirroring the traffic to a port.

Now I'm wondering whether this may not actually be a real / official HP product, due to the following:

  1. The login screen sais ProCurve 1700-8 (J9079A)
  2. The graphical representation says ProCurve 1800-8 (J9029A)
  3. The link status shows port 6 and 8 active, but actually I have connected cables to port 1 and 2

Screenshots:

Login screen

Port status

What is happening here? Could this be a non-original product, and if so, what steps can I take to verify whether this is the case?

1
  • 1
    Curious, can you ssh into the switch? Do the various show … commands get you the correct information? (show version, show system, show name, show interfaces)
    – user1686
    Nov 27, 2015 at 8:29

2 Answers 2

15

I finally figured it out:

My company has bought many HP switches over time of similar types (1700-8 (J9079A), 1800-8G (J9029A), 1810G-8GE (J9449A)) and installed them without changing the IP address and without changing the passwords.

When connecting to the IP of my switch at its default IP 192.168.2.10, the IP address was resolved to a MAC address via the ARP protocol. Depending on which of the switches answered first (or last?), the login was made to the wrong switch, thus the product type and the ports in use changed.

I didn't immediately notice this, except that I wondered why I have to login again. After changing the password, I found that I could not login any more and tried the default password - and it worked.

This made me wonder, so I lokked into the ARP cache. I saw that the MAC address for the default IP 192.168.2.10 changed often. It seems that the ARP cache has quite a short lifetime on Windows. In total I have identified 8 different switches.

IMHO leaving so many switches in default configuration without password is a security risk and I reported that to the IT department. What a pity that they have not detected this themselves.

In order to be able to configure my switch under the given circumstances, I first deleted the ARP cache with

arp -d 192.168.2.10

and then added a static ARP entry for my switch

arp -s 192.168.2.10 XX:XX:XX:XX:XX:XX

I could then connect to my switch and change its IP address to a different value, set the passwort etc.

0
2

ProCurve is a brand used by HP. If my memory serves me right, this brand emerged out of the acquisition of Colubris Networking quite some time ago. I've worked with a few HP products that were made around that time by Colubris Networking (and later HP), and the firmwares seems very similar to what you have.

It should be noted that the model number discrepancy can also be the result of running a very barebone firmware. If you flash the firmware on it, you have to tftp over a very minimalistic firmware, and this minimalistic firmware is used on different models that are similar. As a specific example, I remember msm310 and msm320 (ProCurve access points that are now discontinued) using the same minimalist firmware, so one of them reported the wrong model until you installed the fully up to date firmware on top of that. The port status on these access points was also somewhat odd because of this.

To sum up: I think it's legit, but might be running an old firmware.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.