Tons of Broadcast Frames - Cisco switches

[LCPSWolf]

Hey all,

 

I've got a bizarre issue happening with our school network - random slowness, etc. We do have conficker running around, but I'm also seeing tons of broadcast frames. We have something like 4000 PC's on this one subnet - are the #'s below "normal"?

 

The below section is counters from one of our Cisco 3500 switches:

 

LCHS_315_3524PWR_01#show controllers ethernet-controller fastEthernet 0/1

 

Transmit Receive

799206042 Bytes 1389816217 Bytes

60431643 Unicast frames 23303777 Unicast frames

65213951 Multicast frames 53981 Multicast frames

133576384 Broadcast frames 27038 Broadcast frames

0 Discarded frames 0 No bandwidth frames

0 Too old frames 0 No buffers frames

0 Deferred frames 32 No dest, unicast

0 1 collision frames 0 No dest, multicast

0 2 collision frames 202 No dest, broadcast

0 3 collision frames 0 Alignment errors

0 4 collision frames 0 FCS errors

0 5 collision frames 0 Collision fragments

0 6 collision frames

0 7 collision frames 0 Undersize frames

0 8 collision frames 6347693 Minimum size frames

0 9 collision frames 10266495 65 to 127 byte frames

0 10 collision frames 2692330 128 to 255 byte frames

0 11 collision frames 1323948 256 to 511 byte frames

0 12 collision frames 749170 512 to 1023 byte frames

0 13 collision frames 2005394 1024 to 1518 byte frames

0 14 collision frames 0 Oversize frames

0 15 collision frames

0 Excessive collisions

0 Late collisions

 

My money is on the worm creating the broadcast traffic.

 

Without the obvious (get rid of the worm), is there anything anyone would suggest to:

1. reduce the random slowness of our network

2. limit the broadcast traffic without disabling network functionality to our users

 

Thanks for anything you can suggest!

Edited November 11, 2009 by LCPSWolf
Forgot to tell what my counters were from

[keithu]

You can't really tell much by looking at the counters. I would install a packet sniffer such as wireshark on a pc and have a look at what broadcast traffic you can see. It should be reasonably simple to spot anything weird going on.

 

If you get an impression of what your normal traffic looks like you can compare it with traffic during a slow-down, then you'll know definitively whether broadcast traffic is to blame.

[CyberNerd]

We have something like 4000 PC's on this one subnet

seriously?

 

... so one of the reasons to subnet is to reduce the broadcast domain, incidentally you can also firewall the domains to reduce the spread of viruses