Graphing the number of broadcasts per MAC?

Question

Is there a way, using free network health/analysis tools like Cacti or Wireshark, to produce a list of the number of broadcasts per MAC address or IP address, sorted by the number of broadcasts over time?

I would like to find network devices which are unusually "chatty" and send out far too many broadcasts, thereby reducing throughput for all other devices.

Answer 1

For ad-hoc reports, I would normally do this with minimal Unix tools: tcpdump and awk.

First collect broadcasters with ether address:

$ sudo tcpdump -en broadcast > /tmp/NOISY

This makes a file with a line per packet. Use a different tcpdump filter if you want ip broadcasts or some other restriction. The file will have lots of these:

21:39:49.028308 90:fb:a6:31:91:3e > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 60: 192.168.0.32.3483 > 255.255.255.255.3483: UDP, length 16
21:40:01.862984 34:02:86:7f:e7:dc > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 187: 192.168.0.27.17500 > 255.255.255.255.17500: UDP, length 145
...

Then you use awk to get the second field (ether address), sort them, count the unique values, and sort by numeric count:

$ awk '{ print $2; }' /tmp/NOISY | sort | uniq -c | sort -n
  1 90:fb:a6:31:91:3e
  2 34:02:86:7f:e7:dc
  5 ec:e1:a9:cd:58:22

If you're using wireshark, you can just print the ethernet source addresses, so you'd do something like this:

$ sudo tshark -n -e eth.src -Tfields broadcast > /tmp/NOISY
$ cat /tmp/NOISY | sort | uniq -c | sort -n

Answer 2

Using SNMP you can get the counters for broadcast per switch interface using the broadcast OID , but to get the anomaly behavior detection you will need something more advanced like anomaly detection system

Answer 3

Think of it this way: broadcasts are seen by all machines in a subnet. So put a single machine on all subnets and start counting.

Handwavingly:

• Configure a switch port as a trunk, for every VLAN. Connect it to...

• A Linux machine. Configure an interface with a VLAN interface per VLAN in your network. Configure iptables and ip6tables to drop all traffic out that interface.

Now the interface counters alone are educational. You could install Net-SNMP and plot those directly. You could follow up the high-broadcast VLANs with wireshark for some short-term wins.

For a longer-term issue, install a IPFIX export software on the Linux machine, run that to a IPFIX collector on the same machine, and use the collector's "top talker" feature to generate a regular report.

IPFIX will be massively inefficient overkill, so in the longest term you'd write your own multi-VLAN listener in Python which keeps a table of (vlan, mac) and a decaying average of the number of broadcasts/all-stations multicast. You'd take the maximum of those values and report that back via Net-SNMP to give the network management platform (Nagios, etc) a value to alarm upon.