How to trace a HighBroadcastRate warning?

[andrecsthompson]

Hi Everyone

I have Cisco LMS 2.6 running in my environment.

Recently LMS reported high broadcast rate coming from a switch on port 0/48. See below.

How do I trace the source of the broadcast?

EVENT ID                = 0000QUM

ALERT ID                = 00003AP

TIME                    = Mon 19-Apr-2010 09:38:45 VET

STATUS                  = Active

SEVERITY                = Critical

MANAGED OBJECT          = 192.168.23.95

MANAGED OBJECT TYPE     = Switches and Hubs

EVENT DESCRIPTION       = HighBroadcastRate::Component=PORT-192.168.23.95/0.48 [Fa0/48];AvgInputPacketSize=4439.237;InputPacketBroadcastPct=16.0838  %;Type=ETHERNETCSMACD;InputPacketRate=452.8875  PPS;InputPacketBroadcastRate=452.8875  PPS;DuplexMode=FULLDUPLEX;MaxSpeed=100000000;BroadcastThreshold=15;

CUSTOMER IDENTIFICATION = AndreThompson

CUSTOMER REVISION       = 1.0

Port 48 of this switch is connected to my core switch via a trunk port (802.1q):

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
UWI_MER1_6506.cisco.sta.uwi.tt
                 Fas 0/48           148         R S I     WS-C6506  Gig 3/5

Thanks in advance.

- Andre

[Joe Clarke · Accepted solution]

A sniffer or switch probe would be a useful tool.  You could then analyze not only the source of the broadcast frames, but also their content.  Just span the port in question (Fa0/48) to another port on which you have your sniffer or probe.