Difficult brodcast question

[meirhasin]

Hi

i have some tough question.

i'm working in Lab environment, my company develop network cards and switches.

as part of the engineering work, they make stress and traffic tests on network cards on the servers.

also they have the regualr network( to do SSH and to access to the servers).

so there is trusted network and lab network, sometimes the test out of control and i got massive brodcast(10 giga traffic) on my tursted network.

when i run "show interface port-utilization" i got 80% TX from every port on the switch, why i got TX util on each port?

its not should be TX util from the server that sending brodcast and on the other ports its should be RX util?

someone send brodcast and the other receive it, right?

and the other question, there is option to catch the brodcast sender?

my switches is HP2510 and HP 5406.

thanks

[paulgear · Accepted solution]

The port-utilization counters are shown from the perspective of the switch, not the perspective of the device on the other end.  So if you have one device broadcasting and all the others receiving, then you should see that device's RX counters incrementing (because the switch is receiving the broadcast), and then all the other devices' TX counters incrementing.

As to your question about catching the sender, if it is not a broadcast storm, then looking at the RX counters should point to the culprit.  However, if there is a broadcast storm (e.g. because there's a switch on the other end of one link causing a loop), then this will not help because you'll see high RX on multiple ports.  Turn on spanning-tree bpdu-guard and/or loop-protect to stop this from happening.  There is lots of good information about these features in the manual - just search for those keywords.