Stopping Broadcasts on a Subnet

[DanielBowen]

I have a class B subnet that is being swamped by broadcasts. Below is a screen dump of the show interface command after the counters have just been cleared (check the number of broadcasts). Can anybody give me any ideas on how to stop these broadcasts, or find out where they are coming from.

I am running IP and IPX on this subnet.

Thanks for your help,

Daniel,

FastEthernet10/0/0 is up, line protocol is up
Hardware is cyBus FastEthernet Interface, address is 0060.3ee9.3740 (bia 0060.
3ee9.3740)
Description: *** DK VLAN ***
Internet address is 172.16.10.1/18
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, rely 255/255, load 1/255
Encapsulation ARPA, loopback not set, keepalive set (10 sec)
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters 00:15:05
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 58/75,
1325891 drops
5 minute input rate 497000 bits/sec, 781 packets/sec
5 minute output rate 2000 bits/sec, 2 packets/sec
695930 packets input, 56249700 bytes, 0 no buffer
Received 2019228 broadcasts, 0 runts, 0 giants,
15835 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 watchdog, 0 multicast
0 input packets with dribble condition detected
3952 packets output, 646036 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
DK-Router#

 

[wybnormal]

The easiest way is to get a sniffer of some kind and take a look. Given you have IPX, take a hard look at SAP traffic. SAP is is nasty as it's very easy to get SAP storms where one "server" is slow in responding and then EVERYONE (servers) kicks out a sap broadcast to what they can do. THis is print servers, printserver NLMs, servers, routers, and so on.

ARP storms can be very common with a misconfigured default gateway and/or workstations. Easy to happen if the users get the info via DHCP.. one mistype in a scope can give you heartburn.

The list is pretty long. There are some debugs you can run but if the router is heavily used, you can easily bring it down with a debug.

At my site I have the Ethereal sniffer posted for download. It's "free" and works pretty well. You might want to take a look.

MikeS Find me at

http://www.packetattack.com

"Diplomacy; the art of saying 'nice doggie' till you can find a rock" Wynn Catlin

 

[DanielBowen]

Thanks for the info, have downloaded the sniffer and it looks good..thanks.

Have located the broadcast to a Cat2900XL, so one of the devices on the switch must be causing it.

Thanks again,