2

Today i have detected Cisco ASA 5505 CPU usage went to 100% and LAN was flood with broadcast (ff:ff:ff:ff:ff) going to 10.0.12.255 address, i have noticed all these activity in wireshark that some strange stuff going on.

I jump on firewall (Cisco ASA) and did show conn where i found following

ASA(config)# show conn
1946 in use, 50002 most used


UDP eng  10.0.12.255:44678 inside  10.0.10.92:59654, idle 0:00:00, bytes 21657163800, flags -
ICMP eng 10.0.12.255:0 inside  10.0.10.92:61597, idle 0:00:00, bytes 8142154200, flags
UDP eng  10.0.12.255:31796 inside  10.0.10.92:59654, idle 0:00:00, bytes 18100194900, flags -
ICMP eng 10.0.12.255:0 inside  10.0.10.92:8018, idle 0:00:00, bytes 5909738400, flags
ICMP eng 10.0.12.255:0 inside  10.0.10.92:44296, idle 0:00:00, bytes 0, flags
ICMP eng 10.0.12.255:0 inside  10.0.10.92:19044, idle 0:00:00, bytes 0, flags
UDP eng  10.0.12.0:40776 inside  10.0.10.92:59705, idle 0:00:00, bytes 18865919700, flags -
UDP eng  10.0.12.0:34428 inside  10.0.10.92:59705, idle 0:00:00, bytes 24248390700, flags -
ICMP eng 10.0.12.0:0 inside  10.0.10.92:56833, idle 0:00:00, bytes 7659338550, flags
ICMP eng 10.0.12.0:0 inside  10.0.10.92:3821, idle 0:00:00, bytes 0, flags
ICMP eng 10.0.12.0:0 inside  10.0.10.92:27263, idle 0:00:00, bytes 0, flags
ICMP eng 10.0.12.0:0 inside  10.0.10.92:30586, idle 0:00:00, bytes 0, flags

It was clean 10.0.10.92 doing something bad so we have find source and shutdown that PC (windows desktop) but interesting enough broadcast didn't stop it was still going on.

Finally after 30 minute of dancing i decided to clear conn table and as soon as i did following everything started looking good.

ASA(config)# clear conn address 10.0.10.92
28 connection(s) deleted.

can someone explain me what was going on here?

  • It sounds like you have a broadcast storm where you have a loop caused by an STP failure. Basically, you need to break the loop. That usually involves shutting down switches until the problem is fixed, but then you need to find where you have a misconfiguration for STP. – Ron Maupin May 29 '19 at 17:44
  • This is office LAN ( Not datacenter ) In office i have Cisco ASA5505 and one cisco 2960 switch ( very simple office network ) nothing fancy here, Cisco ASA is just gateway for everyone in office ( NATing), Even no STP in office – Satish May 29 '19 at 17:53
  • Is there any device with two connections? I have even seen Windows PC with bridging enabled cause STP loops. – Ron Maupin May 29 '19 at 17:56
  • We have shutdown PC but still problem was there but when i clear conn it got resolved. trying to understand why firewall keeping them alive.. may be its in loop and firewall can't kill connection because repeating over and over – Satish May 29 '19 at 17:59
  • 2
    That PC is only the source of the broadcast. The loop is somewhere else, and the loop keeps the broadcast alive, even when the source is shut down. If there is only one switch, you need to shut it down and restart. If the problem recurs, then you need to find the loop. – Ron Maupin May 29 '19 at 18:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.