Our performance view in IMC is showing a high level of broadcast packets on a switch trunk port. Is there any way in IMC to see where the broadcast are coming from?
The issue is that IMC is getting that data by polling the network devices via SNMP. Those devices have counters for unicast, multicast and broadcast traffic - but they don't record the sources of that data.
There's no way to poll that data via SNMP, therefore IMC can't tell you the source via that method.
One way to find the source of the broadcast traffic would be to use NetFlow + NTA on IMC. That will tell you the nature of the traffic - source/destination/port/bytes, etc.
Another way would be to use ACLs on the device to log broadcast traffic. (Be careful with this, you might get overwhelmed by logging). It's probably worth looking at storm control on your switchports, or similar.
