cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2254
Views
0
Helpful
5
Replies

Too many broadcast

tonyp8581
Beginner
Beginner

Hi,

We have a monitoring system that gathers statistics from our switches.  From those statistics, we have established some threshold for excessive broadcasts.  If they are exceeded, an alert is sent to the network team.  The threshold is set for 80 per second or > send a Warning alert, and 100 per second or > send a critical alerts.


Recently, on one site, we have being receiving a lot of Broadcast alert.
What's strange is those excessive broadcast are only seen on uplink ports. Access ports show very little broadcast.  After doing a clear counter, both uplink ports show around 110000 broadcast after 10 minutes. The CPU is very low (around 10%). The network is stable, no users are complaining.


So my question is there a rule of thumb (baseline) of broadcast per seconds that's considered normal?  Also, is there a way to find the source of the broadcast without using Wireshark (remote site) ?

 

Thanks !

 

1 Accepted Solution

Accepted Solutions

Some of the switches like 6500 and 4500 allows you to capture packets send to the cpu.

Since it is a broadcast traffic a copy of the packet will be send to cpu also. So what is the platform of this switch.  Also you can think about implementing storm control on all access ports so that the switch drops them as soon as it enters access ports.

 

Thanks,

Madhu

View solution in original post

5 Replies 5

Some of the switches like 6500 and 4500 allows you to capture packets send to the cpu.

Since it is a broadcast traffic a copy of the packet will be send to cpu also. So what is the platform of this switch.  Also you can think about implementing storm control on all access ports so that the switch drops them as soon as it enters access ports.

 

Thanks,

Madhu

Hi Madhu,

I have 2960 and 3560.  Before implementing storm control, I would like to identify the source of the broadcast without using Wireshark ?  Do you know of any command that would accomplish this ?

Thanks !

Tony

 

Hi Tony,

Unfortunately I don't think any command will help you on this specially on the above platforms.

 

Regarding storm control implemenation, you dont really have to identify a source of broadcast. It is rather a proactive meaure to avoid much broadcast to enter the netowork.

 

Hope this helps you. Please feel free to ask questions.

 

Thanks,

Madhu.

 

Hi Madhu,  I guess I'm going to have to send someone on site for some Wireshark.  I'm really curious who is generating this broadcast.  I will eventually look into Storm Control.

Thanks for your help !

Tony

 

Ok Tony. Wish you good luck on it.

If you need any help please open a new discussion

 

Thanks,

Madhu

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers