Packet flooding

[madess]

We are getting packet flooding on our internal network? What would be a good way to find out where it is coming from. We have all catalyst series switches, our main switch is a catalyst 5500. I have software at my disposal including openview. What would be the best way to go about this?

thank you for any help
Matt

 

[FaiTHLeSS]

I would get some sort of packet sniffer search on google for one there quite a few of them. Sounds like you may have the welchia worm on network.

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

 

[netwho]

openview won't help you... you need a sniffer like tool to dig into the payload of the packet. Based on my experience, it's most likely work activities (nachi/blaster e.g.)
who