Can anyone offer any advice on debugging high levels of multicast levels using C3560E routers?
In a large network we have some PCs that have an annoying habbit of sending very large numbers of small multicast packets when in sleep mode. Processing this drags down performance of the edge switches (HP). Currently we track sources down by graphing all interfaces and looking for a solid block of traffic. While this works, you have to wait at least 20 minutes for a meaningful bit of graph to appear.
As the packets are small 'show controllers utilization' does not show a maxed out interface. As the PC has not joined a IGMP group, examining the groups does not help either.
What I am looking for is a command to show current multicast/broadcast levels on all interfaces and if possible show the IP of the top multicast talkers. Is doing a 'show int' then picking out by eye:
5 minute output rate 1000 bits/sec, 2 packets/sec 78336935 packets input, 7571102763 bytes, 0 no buffer Received 0 broadcasts (1270 IP multicasts)
the best way forward? Once we move closer to an edge switch, it becomes an HP problem, but I would appreciate any suggestions to speed up our debugging process.
You could try debug ip igmp on your switch, this will show the igmp packets - of course you are probably better logging this to the buffer rather than the console. Failing that you could limit multicast traffic in general on the switch using storm-control, but that depends on your exact requirements.
Another debug you could try is debug ip mpacket [group ip address] - if all these packets are sourced from different hosts but for the same group ip address, that could be very useful.