8x SG300-52's and all port lights across network are blinking in unison

[JamesLutter]

Setup:

I have 8 SG300-52 switches across 3 floors.  3 on first floor, 4 on second floor, and 1 on third floor.

Floors 1 and 2 are connected by a LAG which is two fiber connections between the top (first) switch in closets.

2nd and 3rd switch on each floor are connected by a 2 port copper LAG to the 1st switch on that floor.

Switch 4 on second floor and the single 3rd floor switch are just plugged into a random port on the 1st (top) switch on second floor.

RSTP has been enabled on all switches and ports with default settings. (as far as I know)

No VLANs.  Aside from setting up static IPs, enabling RSTP, and setting up the LAG groups, the switches are mostly default out of the box configuration.

Problem:

I am not sure if this is a problem, but ALL ports blink very rapidly in unison across all switches (at exactly the same time constantly).  Blink speed fluctuates slightly but never stops fully and is always very quick. Network connectivity does not seem to be affected but I am worried there is a problem which may affect performance.

I see no errors or problems under etherlike statistics. I checked every port on every switch.  

[Philip D'Ath]

The most common cause of this is a unicast flood caused by unknown addresses, broadcast traffic, of multicast traffic.

Lets say a host tries to talk to 192.168.1.1.  Lets say 192.168.1.1 is turned off (or does not exist).  In this case the switches don't know where 192.168.1.1 is, so they have to flood the traffic out every port.

If 192.168.1.1 did exist and was powered back on and generated any kind of packet then the switches will enter this into their forwarding table and the flooding will stop.

The quickest way to figure it out is to plug your machine into a port and make it as quiet as possible.  Stop every application running that you can.  Then run up wireshark and take a capture.  Now look for every packet you have received that is not for your machines IP address.  Those are the packets causing all the lights to flash at the same time.

[JamesLutter]

Hi p.dath, thank you for your input. I have done what you asked and monitored a bit of wireshark. It looks like almost everything in the capture is NBNS protocol with info "Name query NB WPAD<00>" from the same three or four source IP addresses to destination xxx.xxx.xxx.255

There are also a lot of "ARP" protocol with info "Who has xxx.xxx.xxx.xxx? Tell xxx.xxx.xxx.xxx" where those x's are internal IP addresses and the source is not an IP address but a "Dell_##:##:##" where the #'s are a hexadecimal number. The same four or five of that kind of number also seem to repeat.

Does this indicate a problem with the switches not learning something? How do I find out what those strange Dell_##:##:## hex numbers belong to?

Thanks again for the help!

Edit: Also, it looks as though there is an STP protocol packet exactly every 2 seconds saying "RST. Root = 32768/0/00:##:##:##:##:## Cost =  4000 Port = 0x803b" that number is a long hex number that is the same every time.

[JamesLutter]

With a little poking around I found those Dell_ addresses to be MAC addresses, usually for one of the IP addresses in the "Who has ##? Tell ##" info, and its usually from any one of my servers, but sometimes from random machines.

NBNS is netbios.  I'm going out on a limb here and going to guess that everything is normal and I should just live with the 10-20 broadcast packets that are happening per second on my network?

[Philip D'Ath · Accepted solution]

NetBIOS is an old protocol and you should not need it.  Configure you DHCP server to disable the protocol on your clients.

https://support.microsoft.com/en-us/kb/313314

For Arp, the "Tel xx.xx.xx.xx", find out why "xx.xx.xx.xx" is trying to talk to hosts that don't exist.  It may be a mis-configuration.

The STP packets are normal.  Try using RTSP instead of ordinary STP.

[JamesLutter]

Hi thanks for the help.  I have followed the insructions for disabling NetBIOS and figure it will take a while for that to get updated on everyone's PC.

As for the STP vs RSTP, all my switches are set to RSTP.  However, I do have a question about that, should the BPDU Handling Be set to filtering or flooding?  Currently it looks like all my switches are set to "Flooding".

(See attached Picture)

Thank you for all your help.

[Philip D'Ath]

I would say with 8 switches it should be flooding.  Filtering could break the entire tree, if this question is asking what I think it is.

[JamesLutter]

Thanks Philip, I have a related question about ARP but will post in new topic.