Broadcast storm on ProCurve 4000M?

[cxtwo]

Just wondering.. is there any chance that the .8 machine is infected with a worm or virus? Does it or the .2 machine actually exist on your network?

chris

[OLARU Dan]

Is there any ARP reply to .8 requests from .2? Is .2 alive, is .2 TCP/IP stack OK? If .8 gets the answer - why is it forgetting so fast? What about 211.67.1 - does it get some ARP replies?

[Chris Sidwell-Smith]

Sorry I'm personally not familiar with the 4000M only the more recent HP switches.

An ARP request every second or so from a single device is normal. Especially is the .8 device has an application (or virus) that's constantly trying to connect to the .2 device.

If the 4000M is anything like the GL's & XL's I work with then you should be able to tftp off a copy of the current config then see if a factory reset clears the problem.

Also can the management on the switch point to a specific port that is causing the excess traffic? This may help a lot.

[Stuart Teo]

The file name to tftp off newer Procurves is "running_config". The file name to tftp off newer the 4000m is "config"

[David McLean]

192.168.1.2 is the ProCurve 4000M switch itself.

192.168.1.8 is Earth, which I believe is our DHCP server, but I'm not going to be 100% on that until i can get to work and ask our server guy.