Unicast flood on 3750

Utair Corporation · ‎02-28-2013

Hi. There is a unicast flood on 3750 killing slow modem links. How to determine source MAC address of flooder?

Is there a rate limit feature for it?

I know how to block it completely on port-level, but it breaks normal network operation. (when port goes down for some reason, it's learned MACs got flushed and since other hosts know MACs, they keep flooding untill their arp caches expire).

smitesh kharecha · ‎02-28-2013

Use storm-control unicast

Regards,

Smitesh

PS: Please rate helpful posts.

Utair Corporation · ‎02-28-2013

Use storm-control unicast

I tried that. It seems to be blocking all unicast traffic, not just flooding.

smitesh kharecha · ‎02-28-2013

How much limit you imposed ??

Limit argument take input as percent which you need to allow.

100 mean no limit impose and 0 means total traffic will be blocked.

Alternatively it can also be specificed as pps or bps.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12.2_53_se/configuration/guide/swtrafc.html#wp1085979

and which interface you used the command.

Regards,

Smitesh

Utair Corporation · ‎02-28-2013

How much limit you imposed ??

Limit argument take input as percent which you need to allow.

100 mean no limit impose and 0 means total traffic will be blocked.

Alternatively it can also be specificed as pps or bps.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12.2_53_se/configuration/guide/swtrafc.html#wp1085979

and which interface you used the command.

I tried "bps 1m" on all interfaces at once. Almost lost control over switch, turned it back off.

Utair Corporation · ‎02-28-2013

Just checked it a lab, using "storm-control unicast" affects ALL unicast traffic from that interface, not just flood one. So in general LAN it is useless.

smitesh kharecha · ‎02-28-2013

Correct.

That why it is important to chose the limit very carefully.

Basically this command will rate-limit the number of unicast packet which you can send.

If the flood is unknown unicast then, as Peter suggested switchport block unicast is what you need.

Regards,

Smitesh

Utair Corporation · ‎03-01-2013

switchport block unicast is what you need

This might be good for enduser port, but not for uplink to another switch or bridge. If that interface looses it's MAC table for some reason then entire segment behind it will loose it's connectivity for a long time, while host's ARP caches times out or they send something outside their segment.

PS: i've rebooted switch and problem gone for a while. It's probably buggy IOS or faulty hardware.

Peter Paluch · ‎02-28-2013

Hello,

There is a feature called switchport block unicast - would perhaps this be helpful? See more information here:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_55_se/configuration/guide/swtrafc.html#wp1087814

http://www.cisco.com/en/US/partner/docs/switches/lan/catalyst3750/software/release/12.2_55_se/commmand/reference/cli3.html#wp1948063

Best regards,

Peter

Utair Corporation · ‎02-28-2013

There is a feature called switchport block unicast - would perhaps this be helpful?

I've already described what happens if this command is in effect.

Utair Corporation · ‎02-28-2013

Here is what i found while using port mirror:

tmn-rosch-3750#ping 10.131.12.251

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.131.12.251, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms

tmn-rosch-3750#sho arp | inc 10.131.12.251

Internet 10.131.12.251 141 0004.23b7.f983 ARPA Vlan1

tmn-rosch-3750#sho mac address-table | inc 0004.23b7.f983

tmn-rosch-3750#

how could that be?

Seems like a bug with switch.

tmn-rosch-3750#sho ver

Cisco IOS Software, C3750 Software (C3750-ADVIPSERVICESK9-M), Version 12.2(44)SE2, RELEASE SOFTWARE (fc2)

Compiled Thu 01-May-08 15:42 by antonino

Image text-base: 0x00003000, data-base: 0x01840000

ROM: Bootstrap program is C3750 boot loader

BOOTLDR: C3750 Boot Loader (C3750-HBOOT-M) Version 12.2(25r)SEC, RELEASE SOFTWARE (fc4)

tmn-rosch-3750 uptime is 26 weeks, 3 days, 5 hours, 38 minutes

System returned to ROM by power-on

System restarted at 12:13:12 TMN Mon Aug 27 2012

System image file is "flash:c3750-advipservicesk9-mz.122-44.SE2/c3750-advipservicesk9-mz.122-44.SE2.bin"

This product contains cryptographic features and is subject to United

States and local country laws governing import, export, transfer and

use. Delivery of Cisco cryptographic products does not imply

third-party authority to import, export, distribute or use encryption.

Importers, exporters, distributors and users are responsible for

compliance with U.S. and local country laws. By using this product you

agree to comply with applicable laws and regulations. If you are unable

to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to

export@cisco.com.

cisco WS-C3750-48TS (PowerPC405) processor (revision M0) with 0K/12280K bytes of memory.

Processor board ID CAT1028NL8E

Last reset from power-on

15 Virtual Ethernet interfaces

48 FastEthernet interfaces

4 Gigabit Ethernet interfaces

The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.

Base ethernet MAC Address : 00:0A:B8:C1:5B:00

Motherboard assembly number : 73-9680-10

Power supply part number : 341-0028-02

Motherboard serial number : CAT10267XYV

Power supply serial number : DTH10232CMB

Model revision number : M0

Motherboard revision number : A0

Model number : WS-C3750-48TS-S

System serial number : CAT1028NL8E

SFP Module assembly part number : 73-7757-03

SFP Module revision Number : A0

SFP Module serial number : CAT10276AQ4

Top Assembly Part Number : 800-25854-02

Top Assembly Revision Number : D0

Version ID : V05

CLEI Code Number : CNMV300CRE

Hardware Board Revision Number : 0x01

Switch Ports Model SW Version SW Image

------ ----- ----- ---------- ----------

* 1 52 WS-C3750-48TS 12.2(44)SE2 C3750-ADVIPSERVICESK9-M

Configuration register is 0xF

Utair Corporation · ‎02-28-2013

tmn-rosch-3750#sho mac address-table count

...

Total Mac Address Space Available: 1960