Excess VLAN Unicast Sniffing Switchport

mlenco · ‎01-12-2009

When sniffing the vlan using Ethereal I see numerous unicast conversations,in addition to broadcast and multicast. I assumed I would only see unicast conversations between my laptop and the devices it talks unicast and/or broadcast/multicast but never all unicast on a vlan. The port is not spanned. I guess all my servers are getting hit with all unicast on the vlan. How do I fix this? IOS version 122-18 SXF3.

Roberto Salazar · ‎01-12-2009

Sounds like the switch is flooding to vlan, there are several reasons for these to happen.

1. The cam of the switch is full and cannot store anymore learned mac address which would flood the unknown mac-addresses.

2. the cam table is getting flushed, the default is 300 secs - show mac-address aging. Anything less would mean there is STP issue that is causing the mac table to purge the entries.

3. Asymetric path which would be another reason for a mac-address to get purged after the aging time-out, normally, it should refresh but if there is asymetric path, that means the host is taking another path and causing the mac entry on this switch to age out.

These are just the known reasons, other reason could be bug, h/w, etc.

mlenco · ‎01-12-2009

Do you have a troubleshooting document on this? We will most likely walk the spanning-tree paths between our distro and core, perhaps even removing the mesh to see if the excess traffic stops. Thanks for your help.

Roberto Salazar · ‎01-12-2009

Yes, I have the Unicast Flooding in Switched Campus Networks doc here in this link:

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a00801d0808.shtml