Debug IP error help

[neonetsup]

Gurus,

Using Ciscoview to monitor our 3750 switch, I noticed high IP error counts. After connecting to the box and issuing the "debug ip error" command the following output was displayed:

"datagramsize=92, IP 27444: s=192.168.1.100(Vlan1), d=192.168.1.255, totlen 78, fragment 0, fo 0, dispose udp.noport"

The destination IP is the broadcast address of our subnet; Cisco documentation says that "the router received a UDP packet when no application was listening to the UDP port."

I'm trying to figure out why so much udp traffic is destined towards the broadcast address, and what is causing the IP errors.

Thanks for your help!

Kevin

[lgijssel]

UDP broadcasts are a normal solution to initiate connections between clients and servers. This should not nescessarily be an error but it could be a misbehaving application or something like a virus trying to spread.

Your search should focus on the source of the datagrams:s=192.168.1.100(Vlan1) If you are getting these packets from many different hosts, try to figure out which apps they have in common.

In that way, you should be able to find out wether it is caused by an application or a virus.

Regards,

Leo

[ChristopheLucas]

It can be also a routing loop ;-)