05-30-2012 11:08 AM - edited 03-07-2019 06:59 AM
Hello,
We recently implemented a new WAN that is essentially bonded T1s served up to us as a copper hand off. All our remote switches (3560s) connect to our core (3750s). The core is running at layer 3, each remote location has a separate VLAN (and of course subnet) and then we also have several other VLANs that are shared by both our main location and these remote locations. Everything is working fine, frankly performance is what we would expect, however I have noticed the at some of the locations the amount of broadcasts seem to be 10-40% of all input packets on the interfaces that are trunked into the WAN.
Of the broadcast packets input, about 60% are multicast packets. I guess my question is does this seem rather high to anyone else? As I said it doesn't seem to be having a real affect on performance, it just struck me as a fairly substantial percentage of total packets input. Is this just because if there isn't a lot of traffic going over the WAN the percentage of packets that are broadcasts increases simply because the broadcasts will keep happening while the traffic can be more sporadic? As another note, at the head end the interface that trunks into the WAN the percentage of broadcast to total input packets is around 1.8% - 4%
Thanks much to everyone for their help or explanation.
05-30-2012 12:00 PM
Hi Carl,
This is my opinion about the network traffic, in the old days there was some quotes saying that on a routed network the traffic pattern should fit in the 80/20 rule, which 80 is Unicast n 20 is Broadcast. it is old though!
there is not a certain rule or standard to measure the max. amount of the unicast, multicast and broadcast packets that should usually transit the networks. Rather it totally depends on the network's design and services you provide throughout your network.
to see if what you are experiencing is a normal behavior of your network or not, the first step is to identify which devices/services are involved in a broadcast or multicast storms. it could be either healthy RIP OSPF ARP SAP etc. or a product of a design fault or another type of misconfigs in the net.
therefore, to come to a solid conclusion, I suggest you use a decent network analyzer to identify, capture, and categorize broadcast and multicast traffic, identify its sources and then take proper action towards controlling it.
plz Rate if it helped.
Soroush.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide