Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations SkipVought on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

my sniffer is showing some machines 1

Status
Not open for further replies.

ciscobond

Technical User
Jul 9, 2003
13
0
0
GB
my sniffer is showing some machines from my network like 17.4.2.22 sending traffic to 17.4.255.255 why is like that and how to stop this ???
 
It seems those machines are sending data to your entire network. You probably need to impliment access lists to stop that. Or go down and fix the machines themselfs(better solution)
 
What is the subnet mask on the machines?
17.4.2.22 with a 255.255.0.0 mask will send traffic to 17.4.255.255. These will be broadcasts used for DHCP , ARP etc. You can't stop these as your network will not function.
 
Do you have a router with an IP helper address configured?

An IP helper address command can be configured to broadcast to a subnet (the X.X.X.255 address) and this is useful for clients to send broadcast traffic into a subnet with different servers such as WINS, DNS, TACACS, and DHCP on different IPs. So if the WINS server was X.X.X.10, DNS was X.X.X.11 and DHCP was X.X.X.12 the one broadcast would direct the UDP packet to the appropriate server. But be aware that a client doing a DHCP broadcast will cause the WINS and DNS server a bit over overhead to process that packet. This could cause lots of uneeded traffic on your network.



SF18C
CCNA, MCSE, A+, N+ & HPCC

"Tis better to die on your feet than live on your knees!"
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top