3

We are running into a situation where we are seeing a large number of broadcasts received on interfaces that are home to servers. I know this is not normal behavior; ARP cache should remember 100 addresses and the switch is set to remember ARP for 4 hours. Below is the amount of broadcasts we are seeing on two particular ports after 2 days.

FastEthernet0/7 is up, line protocol is up (connected)
     Received 47681 broadcasts (0 multicast)
FastEthernet0/8 is up, line protocol is up (connected)
     Received 6321 broadcasts (0 multicast)

And they are configured the same way: interface FastEthernet0/7

 switchport access vlan X
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 spanning-tree portfast

Any ideas on how to troubleshoot? The issue is widespread on almost all interfaces that house servers in the company.

7
  • 4
    48k broadcasts in two days actually isn't a lot of broadcasts. What real problem is that causing? Commented Mar 2, 2015 at 17:41
  • 1
    ARP aren't the only thing using BCST... Spanning Tree, many services announcing themselves (SMB, CDP...) Commented Mar 2, 2015 at 17:47
  • We are getting performance complaints infrequently, unrelated to available bandwidth. In searching the switch counters we found what we believed to be a large number of broadcasts. Do you have documentation of what the avg no. of broadcasts/multicasts should be?
    – HAL
    Commented Mar 2, 2015 at 17:55
  • Received 103063 broadcasts (4480 multicasts) seems like alot of broadcasts for a PC that wasn't in use (although it was powered on)
    – HAL
    Commented Mar 2, 2015 at 17:58
  • 3
    48K broadcasts in 2 days is 1 every 3-4 seconds. I don't think that is the cause of your problem.
    – Ron Trunk
    Commented Mar 2, 2015 at 18:25

2 Answers 2

4

It's hard not to be caught by the Streetlight effect when troubleshooting performance problems. You have a performance problem, and a limited number of metrics, and you attempt to relate one to the other. Very dangerous, if you have no baseline figures to compare to. It's not even clear that you have a problem with the network at all: often when people report a slow network it's a server problem and vice versa. Keep an open mind on what the root cause is.

If you think you are seeing excessive broadcasts then take a dump with a mirror port and tcpdump/dumpcap; then you can get an idea what kind of packets they are. If they are windows servers, could easily be some sort of service announcement. Unless they are really bursty, it's hard to see how they are related to your problem, though. And that they are the same pretty much everywhere tends to suggest there isn't a particular system with a badly behaved OS or application.

Good hunting!

1

We sat a computer on the switches that were going through heavy broadcast traffic and ran wireshark. What we noticed was a high volume of NetBios traffic and repeated ARP requests where the same host was ARP'ing multiple times for the same target in a matter of minutes.

NetBios was supposed to have been disabled on our network; after turning off NetBios services on the endpoints we were able to substantially reduce the amount of Broadcast traffic. NetBios is extremely chatty and continued to reach out for workgroup information before being disabled.

1
  • I see that often where someone adds a printer and doesn't disable the unused protocols (NetBIOS, IPX, etc.).
    – Ron Maupin
    Commented Mar 6, 2015 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.