Broadcast Storm

[gravitino]

Our network has been showing signs of a broadcast storm, with switches in the remote buildings of our campus logging UPDOWN LINK messages. 

We have MSTP enabled in our core switch (E5412zl), and for diagnostic purposes, we temporarily enabled PORT PROTECT on all of the interfaces in that switch. Port Protect did not report any loops. 

We would like to hear advice from experienced admins regarding possible causes and solutions to this type of issue, as well as any tools that may help us pinpoint the source of the broadcasts.

We are preparing to use Wireshark and port-mirror the worst-offending interfaces, but because that is a tedious process, we'd like to know of other options.

Thank you.

[meirhasin]

Do you have spanning tree enabled?
updown link messages are not cleared sign of broadcast storm, what about switches cpu utilization? did you checked it?