Received ### Broadcast

Danilo Dy · ‎04-25-2007

Hi,

I notice that the "Received ### Broadcast" in my 2960 L2 and 3750 L3 switches is accumulating even though no data is sent, worse if there are data sent to the ports. I don't see this in 6500.

What could be the cause of this and can it be eliminated?

TIA

Switch#sh int fa1/0/1

FastEthernet1/0/1 is up, line protocol is up (connected)

Hardware is Fast Ethernet, address is 001b.2bde.1a83 (bia 001b.2bde.1a83)

Description: TEST

MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Full-duplex, 100Mb/s, media type is 10/100BaseTX

input flow-control is off, output flow-control is unsupported

ARP type: ARPA, ARP Timeout 04:00:00

Last input never, output never, output hang never

Last clearing of "show interface" counters 00:11:41

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue: 0/40 (size/max)

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

9741 packets input, 1665569 bytes, 0 no buffer

Received 12076 broadcasts (0 multicasts)

0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 12 multicast, 0 pause input

0 input packets with dribble condition detected

10080 packets output, 1690843 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier, 0 PAUSE output

0 output buffer failures, 0 output buffers swapped out

Amit Singh · ‎04-25-2007

What is connected to the port where do you see the broadcast. Are you getting the broadcast on everyport or on some specific ports.The valid broadcast would be an ARP broadcast or bootp/DHCP broadcast on the ports.

Where is the intervlan routing happening.is it on 6500 or the L3 3750 switches.

-amit singh

Danilo Dy · ‎04-25-2007

Hi Amith,

Thank you for your reply.

The two switch are not connected to each other. 2960 (L2) is connected to firewalls (PIX, Checkpoint). 3750 (L3) is connected to Router (Cisco), Server (Linux/DNS), Firewalls (PIX/Checkpoint), Switch (3500). The 2960 switch has management vlan configured. The 3750 switch has multiple SVI configured. DHCP service is disabled in both switches. Both switch interfaces connected to an active host shows the same symptoms.

Dandy

Amit Singh · ‎04-25-2007

Dandy,

As I said that it could be a valid broadcast on the ports as mentioned in my earlier post. If you are getting a large broadcast on the switchports, I would suggest you to use a sniffer and configured the SPAN mirroring on the ports to see that kind of traffic is that.This will clearify our doubts about the traffic on the switchports.If its not a valid broadcast, we should be able to find the PC which is generating the broadcast traffic.

Please find the link below for SPAN config on the switches:

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3750/12235se/scg/swspan.htm

HTH,Please rate if it does.

-amit singh

Danilo Dy · ‎04-25-2007

Hi Amith,

Thanks. I already suspect that its ARP broadcast but its too fast to accumulate specially in the 3750. I just power up the 3750 switch and been up for 6 hours. Its in a test (lab) environment. BTW, the 6500 I mentioned is running CATOS :)