Broadcasr Storms

[Matthew Shea]

We are running 2 3com superstack 11 3300 and another new superstack model, over the past couple of months we have been getting broadcast storms that have not been fixed until everything has been switched off and back on. We had a theory that it was an issue with one of the switches but we had a shuffel arround of the patching and took that switch off line but it still occured it doesn't seem to relate to any machines or servers.
can any one please help with some suggestions.

[Ron Kinner]

I answered this yesterday but for some reason it didn't stick.

A broadcast storm is usually caused by a loop in the layer 2 network. Say a host attached to switch A sends out a broadcast, A then forward the broadcast out to all of its other ports. One of the ports is connected to Switch B which also forwards the broadcast out to all of its other ports. One of these ports is connected to switch C which forwards the broadcast out to all of its other ports. So everyone gets the broadcast which is what you want. However, say a port on switch C is connected to switch A. Now when C forwards the broadcast to all of its ports the port connected to A sends the broadcast back to A which does not realize that this is the original broadcast and forwards it out all of its other ports. This builds up the traffic until the switches can't do anything else but forward the broadcast packet around in circles.

The usual solution is to either remove the offending loop or turn on Spanning Tree Protocol which automatically detects and cuts such loops. If you are already using Spanning Tree then it may be failing on you. On some switches you can also reduce the percentage of bandwidth which can be used by broadcasts.

Are your 3300's stacked using the special cable which plugs into the back or are you connecting them via the front?

Are you positive it is a broadcast storm and not a virus infection? The amount of traffic that one of the Blaster style viruses can deliver is astonishing. The one which creates the scvhost.exe file in task manager took down our whole network. Put a sniffer on the traffic next time and see what it really is or check one of your window boxes. Go into Task Manager and click on CPU. That will show you what is using the most CPU time. Normally it should be System Idle but if it is something else then it could be a virus especially if you disconnect the network cable and it continues to use up CPU time.

Ron



Ron