I have Cisco LMS 2.6 running in my environment.
Recently LMS reported high broadcast rate coming from a switch on port 0/48. See below.
How do I trace the source of the broadcast?
EVENT ID = 0000QUM
ALERT ID = 00003AP
TIME = Mon 19-Apr-2010 09:38:45 VET
STATUS = Active
SEVERITY = Critical
MANAGED OBJECT = 192.168.23.95
MANAGED OBJECT TYPE = Switches and Hubs
EVENT DESCRIPTION = HighBroadcastRate::Component=PORT-192.168.23.95/0.48 [Fa0/48];AvgInputPacketSize=4439.237;InputPacketBroadcastPct=16.0838 %;Type=ETHERNETCSMACD;InputPacketRate=452.8875 PPS;InputPacketBroadcastRate=452.8875 PPS;DuplexMode=FULLDUPLEX;MaxSpeed=100000000;BroadcastThreshold=15;
CUSTOMER IDENTIFICATION = AndreThompson
CUSTOMER REVISION = 1.0
Port 48 of this switch is connected to my core switch via a trunk port (802.1q):
Device ID Local Intrfce Holdtme Capability Platform Port ID
Fas 0/48 148 R S I WS-C6506 Gig 3/5
Thanks in advance.
A sniffer or switch probe would be a useful tool. You could then analyze not only the source of the broadcast frames, but also their content. Just span the port in question (Fa0/48) to another port on which you have your sniffer or probe.