UDP flood HELP!

[joan1971]

I have a large network of Baystack 380 and BPS2000 switches and two Passport8003 with MLT between them. They are spread through a wide area of the city and in past few months we have UDP flood incidents that we cannot deal with. There is no obvious reason apart from the fact that all UDP packets are originating in a group of PCs that use NetBIOS to exchange data with eachother.
The only way to stop it seems to be if we disconnect some of the backbone links that seem to be more affected. But I don't think that is a solution to the overall problem.
Can anyone help? Do you think it is cause by some "malfunction" of the spanning tree?

 

[biv343]

Are the Passports running SMLT/IST? You could try enabling rate limiting on the uplink ports if the traffic is multicast/broadcast. I'd also find the affected PCs and see what is causing them to generate that kind of traffic.

 

[joan1971]

Thank you for your reply! I don't have SMLT or IST configured, so I think it's best that I disable NetBIOS from all the PCs that are broadcasting! Too bad they are about 130 PCs!!
:0)

 

[anthonyanderberg]

It might be helpful to know more about the type of traffic.
Have you ever managed to get a packet capture during the flood?

 

[joan1971]

Yes I have. Most of it, is the broadcasts that come from the switches themselves (they are refreshing their MAC/FDB every 5 minutes). These broadcast packets are caught in a loop somewhere (or so it looks like). So, if a logical loop is the case, it is likely that the Spanning Tree algorithm is not working.
But is it possible for the Spanning tree to stop working out of the blue, throughout an entire network (of 65 nodes)?
Because that is what looks like happening: The entire network floods and all nodes stop responding (obviously because they are overwhelmed with packets)!

The only way to stop the flood is to disconnect a few links. Once these links are off, everything goes back to normal. And it's not particular links. It could be any. We randomly start disconnecting and eventually the flood calms down.
Right now we have a working network but it lacks a lot of its redundancy...
:O(