High Broadcast

[scottholwerda]

I have a high level of broadcasts on a subnet. The highest is a mac address in the mac range on one of the modules on our Catalyst 4006. It using 15% of the bandwidth. Is there any way to determine if it is the switch module, or the switch acting on behalf of another device? Could it be a problem with the switch module itself?

Any advice is appricated.

[jroyster]

15% broadcast traffic would indeed cause concern, but only if there is real traffic on the vlan. For instance with no real "user" traffic on a vlan then all your left with is brodcasts and multicasts. I'd get a packet trace (span the vlan to a monitor port) to see what that broadcast traffic really is.

[scottholwerda]

I will have to start monitoring it to see what the traffic is, but the 15% broadcast traffic is being generated by a single host that I am trying to figure out what it is. The mac is one assigned to the range for a module on our switch. Total the broadcast traffic on that vlan has reached 50 - 60%. I have found most of the high broadcasters, and I am trying to figure out if it is software or hardware that is creating the broadcasts. However, the top broadcaster points to the module on the switch, but I want to figure out why that module is broadcasting.

[smif101]

One thing I would look for is who is actually using this switch. If it is adminstrators, then I would check to see if anyone is loading software onto a new machine. Some programs actually broadcast the stream out which can be propagated everywhere. That same problem burnt me for about 3 months until I started turning switches off one by one till I found them :-)