how to reduce broadcast traffic? (router,switches)

[ncohafmuta]

Hi,

I have a network consisting of about 10 Cisco Catalyst 35xx and a Cisco 3660 router. The Catalysts have seperate customers connected to each port. Each customer (maybe 75-100 total) are not part of their own subnet, but part of a /24, of which there are about maybe 10 /24s active in the network. (e.g. Customer1 may be in one /24 and Customer2 may be in another). The customer ports are seeing about 25kb/s of broadcast traffic. I'd like to reduce this traffic without having to re-ip the customer machines. How can I do this?
I'm not a cisco-guru, so any hand-holding is appreciated.
Thanx.

--Tony

 

[baddos]

Through up a WINS server and see if the broadcasts slow down.

 

[ncohafmuta]

it's ARP broadcast traffic.
95% of the network is linux

 

[baddos]

You can't get around arp broadcasts unless you either statically map the mac's - ip's or you further subnet

 

[wybnormal]

If you are seeing an excessive amount of ARP traffic, you need to dig into the architure of the network and possibly a misconfiguration. Every machine will ARP when trying to connect to a host that is not in their local ARP table. That table should be cached for 2-10 minutes depending on the type of OS used on the host. If the host is not on the subnet, then the router will take the ARP and transmit it to the correct subnet by rewriting the header to make it appear that the router is requesting the ARP response. When the host sends the response, then the router will rewrite the header again and send it to the original requester with the correct MAC address. To really track this down, get a sniffer running... NAI, Etherpeek, Ethereal etc.. and take a real look at what is on the wire.

MikeS


Find me at

http://www.packetattack.com

"Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots."
Sun Tzu

 

[fmonteiro]

In the router do a sh ARP and try to figure out if the address you see are the expected ones. You could have a virus in your internal network generating traffic for unkown hosts.
A Sniffer trace, as suggested by wybnormal, is the best toll for debugging this type of ptoblem.

 

[ncohafmuta]

Yeah, i have run nai sniffer pro. 90% of the ARPs are coming from our cisco router and a linux router.

Just a sample..

NAI:
Protocol From Host Packets Out Bytes Out Output Usage
IP_ARP Intel A126B3 2697 172608 0.01%
Cisco 5BBB70 458 29312

CISCO fe0/0:
5 minute input rate 3764000 bits/sec, 635 packets/sec
5 minute output rate 1318000 bits/sec, 609 packets/sec
1802078933 packets input, 1147853899 bytes
Received 64429794 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast
0 input packets with dribble condition detected
1545970453 packets output, 3282677858 bytes, 0 underruns
1975 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
1975 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out

-Tony

 

[shanish]

You didn't specify what is the nature of these broadcasts but here are some IOS commands used to reduce broadcasts :
ip forward-protocol
ip helper-address

If you are running IPX for example (of appletalk) then you have some more options to reduce broadcasts

 

[Dimonet]

The best case scenario is you can at least assign the same subnet to the clients on a specific switch. Once you have done that you can setup VLANS and a VTP server. That way braodcasts will be limitied only to the particular VLAN and they will be ignored and discarded by other segments. This works VERY VERY well. So if you have 10 switches you have 11 vlans.

For example you have your core VLAN that every switch can use to talk to the router. VLAN1

Then you have

VLAN 200 contains all users on one switch 1
VLAN 300 contains all users on switch 2
VLAN 400 etc.
VLAN 500 etc.
VLAN 600

VLAN 200 will ignore VLAN 300 and so on and so on but they will all talk to VLAN 1. So only when a packet from VLAN 200 says hey I want to talk to someone on VLAN300 will the packet be passed throgh to other users. Otherwise broadcasts are limited to users within a VLAN.
etc.

This works wonders in improving network performance

 

[acrmub]

how do different vlans configure in the same(one switch..for example in switch 'A'..two diffenrent vlans configured)switch communicate