01-14-2011 06:18 AM - edited 03-06-2019 02:59 PM
Hi, i have a cisco switch, nothing connected to it except one trunk cable, there is constant 5 Mbps traffic in to this switch, but no output.
can any one help, how can i find this traffic, what debug i can enable which can help out? i tried debug ip options and debug packet, but no luck
i dont have a sniffer at this time :S
sh int g0/2
GigabitEthernet0/2 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 000b.fdf1.181a (bia 000b.fdf1.181a)
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Full-duplex, 1000Mb/s, link type is auto, media type is 1000BaseTX
input flow-control is off, output flow-control is off
ARP type: ARPA, ARP Timeout 04:00:00
1000BaseT module (WS-G5483) in GBIC slot.
Last input 00:00:00, output 00:00:10, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 5435000 bits/sec, 4744 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
969725338 packets input, 2846584134 bytes, 0 no buffer
Received 10777758 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 8337974 multicast, 0 pause input
0 input packets with dribble condition detected
18635 packets output, 2995944 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out
01-14-2011 06:34 AM
Did you try clearing the counters to check if it is still growing at the same rate.
Looks like a lot of broadcast traffic on this trunk port. This could be a malicious PC or a misbehaving NIC. Please set up a SPAN sesion on the port and use wireshark to capture the MAC or possible IP address of the soruce of the traffic.
For creating SPAN
Download WireShark :
HTH,Please rate if it does.
-amit singh
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide