Network analysis - help needed

[earlyriser]

Anyone good at analyzing Wireshark logs? Our Allied Telesis switches are blinking in unison and it looks like a 70's disco. I've tested for loops and not found any so far, so I'm suspecting that perhaps we have something causing some sort of broadcast storm. The problem is, I'm really not sure what is considered 'normal' so am not getting far analyzing the recent wireshark log from my workstation. I've attached the log if anyone is keen/able to have a look and let me know if anything looks suspicious (sorry, it's a 4mb file)

 

Thanks in advance people

capture.zip

[cpjitservices]

I can see alot of traffic from Iphones and Ipods on your network and cache flushes for those devices, there is also a lot of ICMPv6 traffic advertising router soliciting & neighbor advertisements. The other thing that I can see is theres alot of ARP (DHCP) requests.

 

Sorry can see STP traffic on there - to be honest threes alot of traffic but I haven't found anything on there yet that should cause any problems.

[paulfinlay]

Are you experiencing network throughput issues?

 

There's no loop in the VLAN that your wireshark capture was taken from. Do you have multiple VLANs? The loop may be on one of them.

[featured_spectre]

Ipod and Iphone traffic seems to be account for a massive amount of that traffic. Do you use them in your school?

 

Also as with what people have already said, are there any loop backs?

 

Also seems like your unifi devices are clogging up, perhaps there are some heavily used APs?

[SYNACK]

Do you have any layer 3 switches ie the core. If so have you segmented wireless and wired connections into different subnets and possibly different areas of the school. This would limit the broadcasts from the above devices (like the gossipy iToys) from spreading out across the whole network. As a byproduct if there are any devices that are really misbehaving it will limit their effects to that area and make them easier to track down.

 

By splitting the network into routed chunks it will make the whole thing more robust and easier to troubleshoot in future.

 

Your not on the SNAP hosted firewall stuff are you as it seems they had an issue with broadcasts and if their system is not setup quite right (not unlikely) you could be getting broadcasts leaking in from other schools at a high rate even if it is not up to the level of a full network killing storm.

[earlyriser]

Thanks for the replies guys. I've got no throughput issues, and things are working fine, I just noticed that the lights on the Allied Telesis switches were blinking in unison and wondered what, if anything, was going on.

 

No loops that I am aware of. I've got RSTP enabled on all of the switches anyway, and there are definitely no loops between switches. I'll check for network outlets patched to each other etc. We've currently got a flat network, no VLANs. I'm going to put the wireless gear (unifi) onto a VLAN to segregate the wireless traffic, as yes, the iToys do seem to be VERY chatty to say the least. I've got an AT-x900 Layer 3 switch at the core so will route using that.

 

Synack, we are on FX Networks, not SNAP, so don't think it's anything to do with that.

 

Thanks for taking the time to have a look

[pcstru]

Some switches have different modes for the status LED's. Are you sure the switches are set to blink on activity on the individual port rather than when the port is live AND the switch is active (which would cause them to all blink at once)?