5

I am pretty new in Networking (noob), while I was monitoring my network using Wireshark, and I found that there is a lot of broadcasts happening all over the network, broadcast on Local network usually MDNS, NBNS, ARP (Gratitious), UDP[x.x.x.255], UDP[255.255.255.255]. [![enter image description here][1]][1]

[![enter image description here][2]][2]

I wonder whether these broadcast are the reason users facing dips in bandwidth? And How I can mitigate it? Can these broadcast be responsible for packet drops? Also I do not understand user systems are generating ARP broadcast? Doesn't my router should do the same?

Network Topology: We have a simple network consist of a switch (Cisco) which is between the gateway and rest of the Access Points (Ubiquiti) where access points are in Mesh Configuration. Rest of the users are connected an Access Point via WiFi.

Using Ethernet wire CAT-6 (between Router-Switch and Switch-Access_point),

User Count: 50

Wifi freqency: 2.4/5GHz

ISP Bandwidth: 150 MBps (Aggregated)

[![enter image description here][3]][3] (Excuse my drawing skills)

Update This is latest output of broadcast I/O Graph [![enter image description here][4]][4]

  • How is your topology connected? What type and model of network equipment are you using? – user56700 Sep 26 '19 at 10:45
  • We have several Mesh Access Points (ubiquiti) which is connected to a Switch (Cisco) which is connected to the Gateway. – Himanshu Bhatt Sep 26 '19 at 10:54
  • 3
    Broadcasts are not normally a problem when the network isn't totally obsolete. For a start, please add a network diagram, device details and a list of identified problems to your question. It's completely normal for all nodes to ARP servers and gateways. – Zac67 Sep 26 '19 at 11:14
  • 1
    Welcome to NE, we hope you will both contribute to and learn from this community. I wonder whether these broadcast are the reason users facing dips in bandwidth? - sounds like this may be the heart of your real question. As for the images you provide, this is not substitute for being able to look at the actual packet captures but it doesn't look concerning to me (max 10-12 broadcast/multicast frames per second isn't abnormal). – YLearn Sep 26 '19 at 19:34
  • 4
    The broadcasts by themselves are not a problem, but they may be a symptom of something else wrong . It seems like you have a lot for the size of your network. – Ron Trunk Sep 30 '19 at 12:42
3

30 broadcasts/s at 100 bytes each translates to roughly 25 kbit/s. That is not a bandwidth problem with Ethernet, not even remotely.

As Ron T. has commented, the broadcast rate is somewhat high and might indicate other problems you have. You'll need to analyze the broadcasts for common reasons.

For instance, your snapshot indicates several ARP requests for the same IP 192.168.1.143 that may be configured for some central service but might currently be offline.

Additionally, the frequent NBNS broadcasts indicate a problem with DNS. You should run a DNS server that can resolve all commonly used names (or not). Once that's working you should disable broadcast resolution on all nodes.

Also, the broadcasts may be entirely unrelated to your problems. Basic LAN troubleshooting includes:

  • check cabling/L1 connectivity for unexpected link changes and high error rates
  • check L2 connectivity (VLANs) for source/dest MAC presence
  • check L3 connectivity (ping) for local peers and gateway(s)
  • check L3 connectivity (ping, lookup) for DNS server(s)
  • check L3 connectivity (ping, traceroute, service access) for additional servers

Wireless LAN/Wi-Fi complicates things quite a bit. Check cabled nodes first and makes sure everything's fine there. Then, you need to make sure that the used channel(s) are not completely overloaded and there is no radio interference from machinery nearby. For a more detailed diagnosis a thorough survey may be required.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.