Flood of IGMP Traffic

[sidewinder]

Since we got our new core switch we have noticed a problem.
Quite frequently the activity lights on it will just glow solidly, indicating constant traffic.
I suppose its testament to the switch that it doesnt affect the network much, although it makes ping times awful and stops us being able to communicate with the AP's

They never did this with the old switch although it could be we just never noticed?

They are Cisco AP's, which we have all around the school but they are slightly different models, they are 1130AG's whereas our other ones are slightly older 1100's.

They are all in one area and one suggestion was that a power surge could have damaged one. Credible, until we found that when we unplugged what we thought was the cause, 20 minutes later it would be happening again, so it is basically all of them

Is there an option that could be switched on causing massive broadcast traffic or could they just all be faulty? Theres 6 altogether and they were over £300 each so we cant really replace them all. We also cannot use spares of the other type because they are only G, and the Apple Airports in that area already use G

EDIT: changed title to suit the new problem a bit better - could really do with some help on this one

[Grommit]

I had a broadcast storm form a faulty WAP.. took me hours to find it..

[Geoff]

If you have two AP's setup as a bridge an also have them wired this will cause a network loop.

I'd enable STP on all your core switches though aswell.

[sidewinder]

Sorry but what benefit would enabling STP give me?

We havent got any redundant routes to anything so Ive never bothered enabling it, as it doesnt exactly seem a simple task

Dont you have to enable it on every switch if you do it on 1?

[CyberNerd]

Sorry but what benefit would enabling STP give me?

It will stop an accidental (or deliberate) loop from bringing the network down.

For the benefit it gives it is well worth doing, yes you need to log into every switch but it will be worth it in the long run

[sidewinder]

OK fair enough

although in this case, it definatly isnt a loop, its just a case of when the AP's are plugged in the activity shoots up...when you unplug them it stops

Also checked all rooms in that block for any loops

Might consider doing STP at easter or summer though.
One thing Ive heard however is that with it enabled, client machines can take up to 30 seconds to be connected as the switch checks for loops - does that cause any problems?

[ZeroHour]

Ethereal it.
See the packets and see if a PC is screaming (like what happened to us) on its LAN card due to a fault.

[sidewinder]

Good idea Zerohour

Ive done a capture with just one of them active - nothing suspicious really

Now ive plugged them all in and as soon as I see the switch start to go mental, Ill start another one and see whats causing this

Knowing my luck it probably wont happen for days now!

[Ric_]

MRTG can help show particularly high load too.

[sidewinder]

Thanks, not heard of that before. Will give it a go

[sidewinder]

Right, it happened just now. Ran Ethereal and within 30 seconds I had collected 100's of thousands of packets, all IGMP ones, from our core switch saying 'V2 Membership Request'

The destination though was not an access point, but a 224.x.x.x address which is a multicast address if Im not mistaken?

anyone got a clue what they could be

again though, going through and unplugging each AP to see if it stopped it worked - in the end just one was the 'cause'

EDIT: just looked on our core switch (Extreme Summit 7i) and IGMP is enabled. I dont know a huge amount about it but I assume I can just disable it?

[sidewinder]

OK just looked into it a bit more and it seems its used for Ghost multicasting so not something that should be disabled

I was thinking, could there be a computer over in that block that is causing such a large amount of queries? Unfortunatly I forgot to check what was going on in the room where the offending AP was

Or some sort of DOS attack?

[glennda]

Did you ever manage to sort this? i have just looked on our isa and there is loads of IGMP requests to the same broadcast address.

[sidewinder]

Sort of...we replaced 2 of the access points and all was fine I think. Since then though we have a new core switch and all new WAPs though