Noisy broadcasting- How to detect IP?

[steele_uk]

I have 8 Procurve Switches on the network, and i seem to have a problem with a slow steady build up of broadcast traffic that culminates after about 7 days with switch lockups, due to too much data on the network.

 

I have dloaded PCM and can contact and monitor all the switches. I have turned off Spannnig tree, but turned on loop-protect on the two switches that support it.

 

When i looked at the heavy utilization of traffic i noticed that the majority was broadcast traffic, is there some tool that i could monitor the network and drag out a report of noisy host IP's?

 

Cheers

[Ric_]

Wireshark is your friend - Wireshark: Go deep.

 

If you don't turn on port mirroring/port monitoring/whatever it's called on this level of firmware you will only see broadcast traffic but that's what you want anyway.

[steele_uk]

Many thanks.

 

I have 80% UDP traffic to 20%TCP on my Network sample. I would imagine this should be completely the other way around?

 

Can anyone confirm these figures are way out?

[budgester]

Yup, vote for wireshark, you should be able to get to IP that is broadcasting.

 

Could be a dodgy NIC.

 

I know of an IP Phone system that did loads of broadcasting, so had to vlan it off.

[powdarrmonkey]

Many thanks.

 

I have 80% UDP traffic to 20%TCP on my Network sample. I would imagine this should be completely the other way around?

 

Can anyone confirm these figures are way out?

 

No, because they are irrelevant. You're looking for broadcast traffic as oppose to unicast, not protocol differences.

[Ric_]

A lot of broadcast traffic is UDP IME. If you port mirror so that you pick up EBERYTHING, you will find that the UDP traffic is much lless.

 

Ignore the types of traffic and concentrate on the sources.

[Chris_Jones]

if you launch Wireshark and go to Capture -> Interfaces -> Options (for the relevant NIC) then put in the Capture Filter box 'broadcast and multicast' without quotes, It will only capture Broadcast and Multicast packets and ignore any other traffic to and from your machine.

[OutToLunch]

if you launch Wireshark and go to Capture -> Interfaces -> Options (for the relevant NIC) then put in the Capture Filter box 'broadcast and multicast' without quotes, It will only capture Broadcast and Multicast packets and ignore any other traffic to and from your machine.

 

Would have been handy to know that last time I was chasing a cable plugged back into a desktop switch - cheers!

[mpe]

Many thanks.

 

I have 80% UDP traffic to 20%TCP on my Network sample. I would imagine this should be completely the other way around?

 

Can anyone confirm these figures are way out?

 

Without knowing what you are running on your network this isn't much help.

 

Far more use to look at the source and destination IP or MAC addreses. Indeed you'd probably be better off looking at the MAC addresses. Since the troublesome packets need not be IPv4 in the first place.

[Dilbert]

Just a thought, do you have any streeming on that part of the network?

 

Happened here when a tech turned off the IGMP blocking and flodded the network with multicast traffic!! Needless to say, he doens't work here any more