How to track the big broadcaster in the LAN

[johnleee]

We have cisco switches in and cisco routers connected to the LAN. Don't know how to prevent someone from sending out big amount of broadcasting from his/her client pc. Supposed the destination and source of the packets are 255.255.255.255 and 0.0.0.0. It's hard for us to find who send out these huge amount of packets. Appreciate some one could provide some comments.

[jeffrey.zhou]

I think Sniffer is the best tool you can use to track the broadcaster.

[a.manosca]

As mentioned, a sniffer or protocol analyzer can track the source.

What kind of switch do you have? For a probable solution,

maybe broadcast suppression/storm-control should help:

Here are some links:

[Cat6000]

http://www.cisco.com/en/US/partner/products/hw/switches/ps708/products_configuration_guide_chapter09186a008007faf5.html

[Cat2900XL]

http://www.cisco.com/en/US/partner/products/hw/switches/ps607/products_command_reference_chapter09186a008007e90c.html#xtocid1214010

[Cat3550]

http://www.cisco.com/en/US/partner/products/hw/switches/ps646/products_configuration_guide_chapter09186a008007e707.html

Goodluck.

[johnleee]

Hi Manosca, I have difficult to open these linkages as registered user is required while I could hardly get the id from vendor.

[johnleee]

Hi Jeffrey, from the sniffer, it's still hard to find the source broadcaster as the packet information does not contain that, the source address is only 0.0.0.0.

[a.manosca · Accepted solution]

Sorry about that, here are the links again (without login):

http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_guide_chapter09186a008007f2b9.html

http://www.cisco.com/en/US/products/hw/switches/ps607/products_command_reference_chapter09186a008007e90c.html#xtocid1214010

http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_guide_chapter09186a008007e707.html

However, you mentioned you cannot find the source of the broadcast using the

sniffer. But were you able to verify that the packets you have captured includes the broadcast packets you mentioned? Maybe you can try looking for a source MAC address.

Goodluck.

[johnleee]

Yes, the source address fields were all zero. thanks.

[jmcoffey · Accepted solution]

Since these ARE broadcasts and routers do not pass broadcasts (normally) the the broadcasts are definitely coming from the subnet you are seeing them on. Now that the obvious is covered... :-) the only way you will be able to track these down IMHO would be to disconnect devices, possibly in a binary search, and monitor with sniffer. I realize this may be inpractical, esp. during working hours, but if these are present at all times then it may not take all the long during an after hours with two people. One disconnecting switches/hub etc. while the other person is sniffing the network. Once the network device (switch/hub) is identified then you'll need to disconnect one connection at a time.

I do not see any other way to do it

Jim Coffey

[jmcoffey]

Are these DHCP packets (UDP port 67/68)? If so then you have a PC that can not connect to a DHCP server and is probaly misconfigured to has a connection (layer 2) problem to the network i.e. xmit but no receive.

Just a thought...

Jim Coffey

[wilsons5]

John;

If you use a sniffer to capture the broadcast packets, you should be able to get the mac address of the device. Once you have that information you can track the offensive device down via the cam table on your cisco switches. The cam tables will lead you to the specific port which the pc is attached.

Sean