Broadcast storms

[donmatlock1]

Hello,

I currently have 4 HP 2610 switches alongside a Cisco SG 300 28 Port POE.  I have a few laptops that when I look on the old 2610's I can plainly see they are pushing out what may be excessive traffic (AKA broadcast storms) from the login page on the GUI...I am investigating this with the laptops in question by updating drivers, checking for malware etc..hopefully the nics aren't bad as that would be a board replacement.  Anyways, if these laptops were on the Cisco is there a area that I can plainly see what ports or Macs are pushing out what may be a broadcast storm.  Under logs I see I have a flash log etc...but where would I see who is actually in plain english pushing bad traffic similar to the old HP switches?  The reason why I ask is I am retiring the old HP's over time and I want to be "in the know" how to see issues like this without having to go through alot of hoops.

Don

[Michal Bruncko]

Hi Don

I know HP 2610 switches and thus remember about what messages are you talking about. Neither of Cisco switches (Small business or Enterprise) provides same kind of output in regards identification of unexpected traffic pattern on ports.

But on the other side they have options how to avoid and identify loops in switched networks. This means that instead of receiving "Excessive broadcasts received on the port X" you will get something like "STP Loopback Detection." in case there is really switching loop in network. Moreover with releasing firmware 1.4.0.88 new feature was introduced for avoiding loops in network: Loopback detection – Detects network loops using non-BPDU frames, and usually used where spanning tree cannot be used.

There is also Storm control feature on SG300 switches, but it is like prevention mechanism instead. More here.

I.e. in another words, Small business switches have resources and options how to detect switching loops with blocking of switch ports from where storms are coming from.

One more thing: "Excessive broadcasts received on the port X" on HP not always pointed to broadcast storms, but yes is usually caused by a network topology loop, but can also be due to a malfunctioning device, NIC, NIC driver, or software application.

hope this helps..

[donmatlock1]

Thank you.  I had enabled STP loopback detection previously on the one Cisco switch thats in that group.

So what i have done is moved the devices in question to the Cisco and also enabled storm control with a threshhold of 4 MB till I am able to round up the devices in question...at least they will be under control of some sort.  My additional question is, I was able to determine what devices were having issues through the HP's, but in the future when i switch to Cisco entirely, how will I know I have any issues?