2950 Switches with broadcast storm activity

[peterd51]

Hi Guys,

I have a site with a couple of dozen switches where four switches regularly drop off the network for 2 - 3 seconds at a time.

Looking at 'show process cpu' I find...
"30 11905810 10688854 1113 1.43% 1.62% 1.66% 0 Broadcast Storm"

The per-centages vary up to 2.50% for the five seconds value, which pushes the one minute figure up to about 2%.

Is this normal for a 2950 or could I have a problem with STP?

Looking at other sites with different switches, the 3500 for instance, doesn't show anything like this.

Regards
Peter

 

[vipergg]

Whats in the log during the time that these drop off ? Obviously something going if they are dropping off . I don't even see that line in the show proc cpu on our 2950's .

 

[peterd51]

Hi,

the logs show various fastethernet ports dropping and reconnecting at different times during the day.

Nothing for the gigabit ports though and these connect the switches to the network. If the whole switch was dropping I'd expect to see the gig ports going down.

Unless they actually mean that particular PC's/servers are dropping off but being typical users they report that everything has gone...

There's been a follow-up report from the site that some users can't access the mail-server. So I started to do some tracing of connections late yesterday afternoon and thought I'd got something as PC's started dissappearing from the network from about 3.00pm onwards.

Unfortunately the site's in Ireland and people were just logging off early to get home for todays celebrations.

Regards
Peter

 

[darbyweaver]

Have you enabled portfast on the ports with PC's / Servers?

Sometimes when PC's / MACs etc cannot get to network resources, portfast is a lifesaver.

Note: Careful here as you typically want only single access devices attaching to that port (i.e. one nic and not a hub).

You can read the message when you enable it.

Hope this helps...

 

[peterd51]

Hi,

yes, portfast is enabled on server/PC ports.

I've checked the logs of all switches and made notes on the network diagram to look for any patterns.

Four of the switches in one area of the network are 're-learning addresses' at regular intervals.

I thought this may be due to a dodgy link coming in and out and causing spanning-tree to run at various times during the day.

Could this be classed by the CPU as a broadcast storm?

One of the other guys here thinks it's down to a PC being turned on and off but that seems a bit odd to me.

I once accidentely caused a broadcast storm when I connected new HP 4108's together with two links...I didn't know beforehand that the HP has STP turned off by default (I'd always used Cisco up to then and of course STP is on by default).

It was pretty much instant lock-up...within ten seconds every link-light was on solid and stayed that way for about 20 seconds after I disconnected the second link.

This problem is more intermittent...

a temporary network loop, or something switching in/out, etc.

Regards
Peter

 

[fynx]

Have a think about enabling the unidirectional link detection feature on your switches interlink interfaces.

In interface config mode: udld enable

Unidirectional links are often a cause of relearning MAC addresses. Also, make sure you know the STP configuration of your network. Draw it out, and make sure you know where the root bridge(s) are and the normal STP state. That way if you check your stp domain, you can tell at a glance if something is amiss in bridge world.

good luck,



If everything is coming your way then you're in the wrong lane.

 

[peterd51]

Hi,

interesting point...I hadn't considered udld, thanks.

I've been tied up with routine ISDN testing for the last few days (it's unbelieveable how many ISDN's fail due to circuits being ceased in error!) and the site that had the problems has gone quiet for now.

This gives me time now to play around with things before they complain again...

Regards
Peter