cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
651
Views
0
Helpful
1
Replies

one way Input Traffic on Cisco switch Trunk, Nothing connected on it

ahmad82pkn
Level 3
Level 3

Hi, i have a cisco switch, nothing connected to it except one trunk cable, there is constant 5 Mbps traffic in to this switch, but no output.

can any one help, how can i find this traffic, what debug i can enable which can help out? i tried debug ip options and debug packet, but no luck

i dont have a sniffer at this time :S

sh int g0/2
GigabitEthernet0/2 is up, line protocol is up (connected)
  Hardware is Gigabit Ethernet, address is 000b.fdf1.181a (bia 000b.fdf1.181a)
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Full-duplex, 1000Mb/s, link type is auto, media type is 1000BaseTX
  input flow-control is off, output flow-control is off
  ARP type: ARPA, ARP Timeout 04:00:00
  1000BaseT module (WS-G5483) in GBIC slot.
  Last input 00:00:00, output 00:00:10, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 5435000 bits/sec, 4744 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     969725338 packets input, 2846584134 bytes, 0 no buffer
     Received 10777758 broadcasts (0 multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 8337974 multicast, 0 pause input
     0 input packets with dribble condition detected
     18635 packets output, 2995944 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 PAUSE output
     0 output buffer failures, 0 output buffers swapped out

1 Reply 1

Amit Singh
Cisco Employee
Cisco Employee

Did you try clearing the counters to check if it is still growing at the same rate.

Looks like a lot of  broadcast traffic on this trunk port. This could be a malicious PC or a misbehaving NIC. Please set up a SPAN sesion on the port and use wireshark to capture the MAC or possible IP address of the soruce of the traffic.

For creating SPAN

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#topic5

Download WireShark :

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#topic5

HTH,Please rate if it does.


-amit singh