3com 4050 lots of activity

[bignogin]

We have been noticing that there has been a massive amout of activity on our network. We have about 200 users, 4 3com 4400 switches, 2 cisco 3500s and one 3com 4050 as core.

Over the holidays I went into the office to so some work on a server. I noticed that the lights on all the switches were going insane. They always flicker on and off though out the day, but to do this when no one was working was odd. SO I went and shut every computer in teh company off, except teh servers. There was still massive amounts of activity. I logged in to the 3com 4050 and checked teh history and is says that there is millions of packets/hr on all the active ports.

I am no networking specialist, but id liek to attempt to look into this. Am I on the right track if I use some packet sniffing sowtware internally? Also we just had a network audit from a local IT company and they never had anything odd in their report.

Any help would be great thanks

 

[IRudebwoy]

A packet sniffer is a good idea. Make sure Spanning Tree Protocol is configured properly. And I've also had some old HP jetdirect cards start a broadcast storm if not restarted periodically.

Have Fun!

 

[bignogin]

I just walked into this company... There are alot of older jetdirects though. It may not be a bad idea to segment the network also.

 

[bignogin]

I used wireshark for about 30min. The majority of the traffic is arp. Mostly: "Who has 192.168.3.1? Tell 192.168.3.124". With the same Ip addresses

 

[cknipe]

also if you use an NBX telephone system, the Music on hold is sent as a multicast to all ports on the switch. Also may be a cause...