100% broadcast (multicast) packet received

[dahgenegweon]

Hello,

On my switch, I have 100% broadcast (multicast) packets received on one of the interfaces as below.                   

GigabitEthernet1/2 is up, line protocol is up (connected)

     702184 packets input, 58881856 bytes, 0 no buffer

     Received 702184 broadcasts (702184 multicasts)

I would like to know if this is problematic (i.e. virus) or it could be a normal behavior

since it is multicast traffic not broadcast traffic.

Thank you in advance

[cadet alain]

Hi,

what is linked to this port ? you should also sniff the traffic to see which multicast address is involved.

Regards

Alain

Don't forget to rate helpful posts.

[lauxtobias1]

Do you have storm-control active on this interface?

I don't know the time range in which this multicasts were recieved, but you should consider it to prevent high interface util.

http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_22ea/SCG/swtrafc.html#wp1063295

[mfurnival · Accepted solution]

If you include the full output from "show interface G1/2" we can see how long it is since the counters have been cleared. Include a "show version" and we can see the switch uptime. If you have received that many packets in 1 hour then that seems high - if you have received that many in 3 years then that is a different story...

[dahgenegweon]

Dear mfurnival,

Thank you for your answer.

I removed the other lines on purpose since I did not find any unusual events such as errors, collisions, pps, etc.

As you mentioned, the multicast packets were received on that port over a week;

and since the peer device (Windows Server) is not in service yet, I figured this is not a big deal.