1

Is there a way, using free network health/analysis tools like Cacti or Wireshark, to produce a list of the number of broadcasts per MAC address or IP address, sorted by the number of broadcasts over time?

I would like to find network devices which are unusually "chatty" and send out far too many broadcasts, thereby reducing throughput for all other devices.

  • 2
    I have had it with the programmers who think using broadcasts is the way to do things. I have tried, over and over, on Stack Overflow to explain that they should be using multicast in almost all the cases for which they want to use broadcast. Some that use multicast are using the all nodes multicast group, which is really the same as broadcast. If a host wants to discover a server, or vice versa, or peers discover each other, then have the application use a specific multicast group, don't constantly broadcast. Sorry about the rant. – Ron Maupin Sep 6 '17 at 13:23
  • Once you discover the hosts that unnecessarily broadcast, you can use VLANs to place them on a separate broadcast domain, and those hosts will then have the bad throughput, instead of all the hosts. – Ron Maupin Sep 6 '17 at 13:24
3

For ad-hoc reports, I would normally do this with minimal Unix tools: tcpdump and awk.

First collect broadcasters with ether address:

$ sudo tcpdump -en broadcast > /tmp/NOISY

This makes a file with a line per packet. Use a different tcpdump filter if you want ip broadcasts or some other restriction. The file will have lots of these:

21:39:49.028308 90:fb:a6:31:91:3e > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 60: 192.168.0.32.3483 > 255.255.255.255.3483: UDP, length 16
21:40:01.862984 34:02:86:7f:e7:dc > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 187: 192.168.0.27.17500 > 255.255.255.255.17500: UDP, length 145
...

Then you use awk to get the second field (ether address), sort them, count the unique values, and sort by numeric count:

$ awk '{ print $2; }' /tmp/NOISY | sort | uniq -c | sort -n
  1 90:fb:a6:31:91:3e
  2 34:02:86:7f:e7:dc
  5 ec:e1:a9:cd:58:22

If you're using wireshark, you can just print the ethernet source addresses, so you'd do something like this:

$ sudo tshark -n -e eth.src -Tfields broadcast > /tmp/NOISY
$ cat /tmp/NOISY | sort | uniq -c | sort -n
1

Using SNMP you can get the counters for broadcast per switch interface using the broadcast OID , but to get the anomaly behavior detection you will need something more advanced like anomaly detection system

1

Think of it this way: broadcasts are seen by all machines in a subnet. So put a single machine on all subnets and start counting.

Handwavingly:

  • Configure a switch port as a trunk, for every VLAN. Connect it to...

  • A Linux machine. Configure an interface with a VLAN interface per VLAN in your network. Configure iptables and ip6tables to drop all traffic out that interface.

Now the interface counters alone are educational. You could install Net-SNMP and plot those directly. You could follow up the high-broadcast VLANs with wireshark for some short-term wins.

For a longer-term issue, install a IPFIX export software on the Linux machine, run that to a IPFIX collector on the same machine, and use the collector's "top talker" feature to generate a regular report.

IPFIX will be massively inefficient overkill, so in the longest term you'd write your own multi-VLAN listener in Python which keeps a table of (vlan, mac) and a decaying average of the number of broadcasts/all-stations multicast. You'd take the maximum of those values and report that back via Net-SNMP to give the network management platform (Nagios, etc) a value to alarm upon.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.