Excessive HSRP Hello Message

[nojpt]

Hi,

I encountered a loop problem a couple of days ago created by Windows XP machine with network bridging enabled.

My setup is that, i have two cat65 as core switches. I have a stack of 2900/3500 access switches per subnet connected to both cat65s using HSRP with load balancing (two HSRP group). So i divided my subnet into two. One going to Cat65-1 and the other going Cat65-2.

This XP machine have two NICs connected to the same 3500 access switch. Now, when the Network Bridging feature of XP is enabled, a loop was created.

That brought down my two Cat65s with CPU utilization going up to 90%-100% because they were dumping a lot of duplicate address syslog messages.

I put up a sniffer to the same 3500 access switch where the XP is connected and i noticed that there was so many HSRP Hello message being sent by both Cat65s. At an average of 1500 HSRP hello message per second. So both of them were producing something like 3000-4000 hello message per second. This amazed me since my HSRP was configured with 2 seconds Hellotimer.

I can understand why my CAt65s are reporting duplicate address. But why producing so much Hello message? Switching from Active to standby repeatedly.

Anybody can enlighten me why is this so?

Thanks.

jonathan

[lgijssel]

I think that the excessive hello's were introduced by the loop you mentioned.

As they were bridged, you are not able to distinguish between 'real' hello's and replications. Breaking the loop will have caused the hello's to drop to normal again. Under normal circumstances, there is one hello per interval.

Regards,

Leo

[nojpt]

I agree it was the loop that triggered such event. But exactly why and how i don't know. Which is what im interested about since i have to do a post-mortem report.

Thanks for sharing your thoughts.

[lgijssel · Accepted solution]

This will always occur if you have a bridge-loop in the network. A more familiar name is: Broadcast storm. That is what drags you network down, not the unicasts.

It is a habit of bridges in general to forward multicasts. The HSRP-hello's are multicasts. These, and broadcast frames together are replicated thousands of times in a split-second hence overloading your switches.

[nojpt]

Thank you. That's explains the voluminous multicast hello messages.