NIC's Capacity.

[sarunsut]

Dear all,

My network is using 10 Mbits LAN mix with 100 Mbit LAN and I also run multiprotocol in the same network (IP and IPX). Now, I got a problem about "Broadcast Strom" (it is about more than 60 broadcast frames per second).

I wonder that how this problem impact to all hosts' performance. By the hand, if we have 100 Mbits NIC, the 60 broadcast frames per second should be able handle by NIC? How can I measure that each NIC has enough capcity to handle this situation.

Thanks in advance for your kindly help.

Rgds,
Sarun S.

 

[onepair]

Thats a very good question...anyone?

 

[mpennac]

The broadcasts on your network have two impacts on performance. The first is the use of bandwidth and the second is the impact on the workstation processors.

Let's look at the impact on bandwidth. A typical broadcast packet is somewhere between 64 to 100 bytes in size. A rate of 60 per second equals about 3840 to 6000 bytes per second, or a maximum of 48,000 bits per second (6000 bytes * 8 bits/byte). This represents 0.48% of bandwidth on a 10Mbps link. The result is no significant impact on bandwidth.

Next is the impact on the workstations. Each time a workstation or server receives a broadcast, it must look at the contents of the frame to determine if it should move it up the protocol stack. If an IP only device receives an IPX broadcast, it must still look at it. This means that every broadcast on your network will cause an interrupt on every device that receives it.

A typical Windows 2000 device runs at about 100 interrupts per second when it is just sitting there doing nothing. I have done experiements in class where we transmitted 2,500 broadcasts per second onto the network to see the impact on the workstations. The interrupts per second went up, but there was no visable impact on the performance of the computers.

Long story put short, 60 broadcasts per second is not enough to worry about. If you were seeing 500+ broadcasts per second, worry. I would suggest using a protocol analyzer such as Ethereal to capture some of these broadcasts and look at them. IPX is very broadcast intensive, especially if you have lots of services. Virus infected computers can also increase the number of broadcasts. These will usual show up as ARP frames as the infected computers try to find other computers to infect.

Hope this helps.

mpennac

http://www.netprospecialists.com

 

[sarunsut]

Thanks for "mpennac", your helpful information make me more understanding. However, I am still quite confusing on the figure about broadcast per second.

You mention about that "the amount of 60 broadcasts per second is not enough to worry". I have read and find some information about this figure in the net. Some source said that the 40 broadcasts per second should be declared to be a "broadcast storm" problem. Some said that "18 broadcasts per second to be aware". The 5 broadcasts per second stay for 10 second should be identify a "critical problem". Those figure number make me confuse.

So, can anyone suggest me for a simple figure to identify about the problem on the broadcast flood in the network.

Thanks in advance.

 

[mpennac]

You are welcome.

In the old days, Windows 3.1, the workstations could be adversely affected by too many broadcasts. Today, with WINS queries, large broadcast domains, NetWare SAPs, and other such protocols there is an increase in the number of broadcasts per second.

A rate of 40 per second is still pretty low. I consider a "Broadcast Storm" to be a case of a data link layer loop in the network where packets are being sent out at a rate of thousands per second.

The best technique in determining if you have a problem is to throw a protocol analyzer on the wire and see what type of broadcasts your network is experiencing. If there are broadcasts that could be eliminated, work on getting them off the wire. Otherwise, the broadcast rate you are seeing may be normal for your network configuration.

Mike

http://www.netprospecialists.com