10.1.1.1 is flooding the network.

[terrydarst]

I noticed the network running slow so I ran wireshark 10.1.1.1 is flooding the network. Why is it doing this and how can I stop it?

48813    792.816260    10.1.1.1    239.10.16.16    UDP    218    Source port: cisco-sccp  Destination port: cisco-sccp

[Arturo Bianchi]

Hi,

You can try to disable MOH (Music On Hold) on internal call... When disabled, the UC500 don't send multicast packet with MoH but this generally don't flood Your network.

73,

Arturo.

Sent from Cisco Technical Support iPhone App

[terrydarst]

I dont beleave it's a MOH issue. I have a 7975 on the system and when I disconnect it the flood stops. I have disabled VoiceView Express and Live Reply. Reconnected the phnone and the packets have stopped.

[David Trad]

Hi Terry,

This sort of traffic shouldn't be slowing down your network at all, the VLAN segregation should be forming a sort of container on this and providing some basic protection to the data network, and the SCCP traffic is just a form of heartbeats anyway.

Have you used CCA to do traffic analysis and and see how much network utilization is taking place? You can drill down on a port-by-port basis and get a pretty good idea of what is happening over the network and see if there is any particular port that is generating excess traffic. CCA is a pretty good tool for this

Cheers,

David.

[ibondar]

Hello Terry,

I agree with Arturo - it should be the multicast stream created by MoH, at least destination IP address and source/destination UDP port are the same as UC500 should use by default for MoH stream.

If you will take a look at the default running-config of a UC500, you will see following settings:

UC_560#sh run | i moh

moh flash:/media/music-on-hold.au

multicast moh 239.10.16.16 port 2000

which means in this scenario UC500 will send UDP stream containing audio from

flash:/media/music-on-hold.au to IP 239.10.16.16, destination port 2000

If you don't want MoH traffic to flood voice vlan ports, I advise you to set up IGMP snooping on the switch and enable

filtering of unregistered Multicast frames. It is possible to set up a switch in such way that if MoH is not used by any of your phones, it won't be propagated to the voice vlan ports, but if MoH will be requested by any phone (like when you put on hold someone), switch will pass through multicast stream to that only port and will stop the stream when your phone no longer needs it.

But all this setup should be made on the switch itself, there is nothing we can do on the UC500 about it.

Regards,

Ivan

Cisco SBSC UC Engineer