Evening, I keep getting 172.10.37.255 .res.spectrum.com,
I check this 151.101.2.132 IP and I get this:
I thought It was clashing with another assigned IP, so I changed it to 172.100.137.0/24, but it capturing that IP also.
What is causing this and who is .res.spectrum.com and how is it transmitting my VLAN IP?
There is two separate factors here that are causing your flows to look like this.
First, it seems you are using publicly routable IP addresses such as 172.100.137.0/24 as private IPs inside your network. You may be thinking that anything starting with 172 is fine for internal use, but actually only 172.16.0.0-172.31.255.255 (172.16.0.0/12) is reserved for private network use. Everything outside that range (and 10.0.0.0/8 and 196.168.0.0/16) are assigned to real public networks. If you use one of those IPs for your internal network, it won’t cause any of the public traffic to “come to you”, but it will mean that you won’t be able to reach those public IPs because your router will expect to find them internally.
Second, the flow tool doesn’t see DNS names in the traffic it is reporting, it just sees IP addresses, and then does a reverse DNS lookup to try to add meaningful data. Because you are using public IPs internally, the reverse lookup result is that of the public IP, not your internal one. Hence why you’re seeing things like res.spectrum.com.
