VERY strange 3750 behaviour

[psmidcnss]

Good morning,

in our datacenter we are using two 3750G stack as L2 core switches; in the last year we're suffering a strange problem: we're seeing unicast traffic spread over all trunk ports (basically all the uplink to the satellite switches). In the beginning we thougth it was an unicast flooding, but latest test show that:

- access ports are not affected by this issue: if we connect a sniffer to a port in access (not in span) we are seeing only normal traffic (broadcast/multicast)

- trunk ports are affected by this issue: if we connect a sniffer  to a port in trunk (not in span) we are seeing unicast traffic!

- during the issues the mac address table is not full

- it seems that if we restrict the number of vlan on the trunk (e.g. 1-100) we're seeing odd traffic but only of the allowed vlan (no inter vlan flooding)

Can anyone give us a suggestion? We thougth it was an IOS bug and this summer we upgrading the IOS to the 12.2 (55) version

Thank you so much!

Marco Canova

[Somasundaram Jayaraman]

Hi Marco,

Have you checked whether vtp pruning is enabled or not?

can you try configuring vtp pruning and see if that fixes the issue.

conf ter

vtp pruning..

VTP has to be enabled globally

cheers

Somu

Rate helpful posts

[psmidcnss]

Hi Somu,

yes vtp pruning is enabled everywhere, but we think it's not working properly. The next step we planned is enabling manually only the useful vlan on every trunk (at the moment all the vlan are allowed on every trunk).

I'll let you know in the next days.

Thank you so much

mc

[acampbell]

Hi,

Is you L3 switches in the data centre running HSRP

If so

You unicast flooding  issues could be being caused by the lack of adjustment of the

MAC address aging timer

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a00807347ab.shtml#broadcast

mac−address−table aging−time 14400 (seconds)

This should equal the ARP cach time of 4 Hours (14400 Seconds )

HTH

Alex

[psmidcnss]

Hi Alex,

I saw that suggestion, I didn't think about our L3 core (that use HSRP) I focused on our L2 core. Well we could try.

I'll let you know.

mc

[psmidcnss]

About flooding: we analyzed the wireshark capture and saw that most of the traffic was Microsoft NLB ... We're trying to fix the issues according to this document:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_example09186a0080a07203.shtml

mc