Too many broadcast

[tonyp8581]

Hi,

We have a monitoring system that gathers statistics from our switches.  From those statistics, we have established some threshold for excessive broadcasts.  If they are exceeded, an alert is sent to the network team.  The threshold is set for 80 per second or > send a Warning alert, and 100 per second or > send a critical alerts.

Recently, on one site, we have being receiving a lot of Broadcast alert.
What's strange is those excessive broadcast are only seen on uplink ports. Access ports show very little broadcast.  After doing a clear counter, both uplink ports show around 110000 broadcast after 10 minutes. The CPU is very low (around 10%). The network is stable, no users are complaining.

So my question is there a rule of thumb (baseline) of broadcast per seconds that's considered normal?  Also, is there a way to find the source of the broadcast without using Wireshark (remote site) ?

Thanks !

[Madhukrishnan Gopinathan Nair · Accepted solution]

Some of the switches like 6500 and 4500 allows you to capture packets send to the cpu.

Since it is a broadcast traffic a copy of the packet will be send to cpu also. So what is the platform of this switch.  Also you can think about implementing storm control on all access ports so that the switch drops them as soon as it enters access ports.

Thanks,

Madhu

[tonyp8581]

Hi Madhu,

I have 2960 and 3560.  Before implementing storm control, I would like to identify the source of the broadcast without using Wireshark ?  Do you know of any command that would accomplish this ?

Thanks !

Tony

[Madhukrishnan Gopinathan Nair]

Hi Tony,

Unfortunately I don't think any command will help you on this specially on the above platforms.

Regarding storm control implemenation, you dont really have to identify a source of broadcast. It is rather a proactive meaure to avoid much broadcast to enter the netowork.

Hope this helps you. Please feel free to ask questions.

Thanks,

Madhu.

[tonyp8581]

Hi Madhu,  I guess I'm going to have to send someone on site for some Wireshark.  I'm really curious who is generating this broadcast.  I will eventually look into Storm Control.

Thanks for your help !

Tony

[Madhukrishnan Gopinathan Nair]

Ok Tony. Wish you good luck on it.

If you need any help please open a new discussion

Thanks,

Madhu