VLAN - too much broadcasting

[brettums]

This is going to be a very broad question.... I'm hoping someone can suggest somethings I can look into to try and find out what's happening.

My network is segmented into 13 VLANS. One of those 13 VLANS I'm noticing extremely sluggish downloadtime..... This VLAN is for PUBLIC access only. Ex. I work in a school and all lab areas are considered public machines. I'm in a mixed environment of WinXP and OSX Panther/Jaguar. All PC's are using Symsantec AV corp. However, Macs are not..... I'm really leaning toward a virus outbreak which has happened on this subnet (VLAN). I just don't know what tools to use when tying to find out if it's true or not. The backend is all cisco.... using for switches 2950, 3548, 3524 and for routing a 3750...... anyone recommend how to use debugging or better yet an app that can help me pinpoint what is going on? If you need more details please let me know.

FYI, I've tried using the etherreal port sniff (free edition) but that seems to not even find anything but normal broadcast (such as DHCP) FYI, no appletalk is on... I know better...c'mon this is the 21century LOL)

thanks
-Brett

 

[lgarner]

If you want to sniff traffic on a switch, you'll just need to enable a port to mirror all others. Preferably a gigabit port. Check the switch docs; sometimes it's called a "monitor" port, sometimes "mirror". I don't remember Cisco's term.