Hi - new to Cisco here, and would like to get some thoughts from the group. Hope I'm posting this in the right area. I'm helping troubleshoot some strange network behavior, so any input to point me in the right direction would be appreciated given my newbie status with Cisco gear. I've looked over all the configs and have been eyeing the spanning tree config as a potential cause. I'm targeting each config line I come across and researching everything I don't know, but I have a lot to learn. In the essence of timeliness, I'd also like to get some group input if possible.
Network is multiple 2950 & 3560's, single VLAN. On multiple devices & ports, there is a constant 2.7-2.9Mbps inbound flow of constant broadcast traffic to the client. This was detected through various tools, and verified in multiple Wireshark traces. On most switches it is Sourcing from a Cisco MAC address and going to a destination of 01:00:0C:00:00:05 (multicast). One one or two other switches, there is similar inbound traffic floods, but the source is an IPv6 address with a destination of FF02::16 - packet is a Multicast Listener Discovery message.
Most of the switches are just operating in simple layer 2 mode and the ports are not configured with any spanning tree configuration at least from what I can tell from the running config, although most switches have a global command that states:
spannig-tree extend system-id
One of the core 3560's is in PVST mode, and trunking is enabled on all it's interfaces.
Only on one end user switch do I see spannig tree/portfast enabled on all ports.
I'm currently working on obtaining a physical connectivity map, but given the inbound flood of packets, does it sound like a STP misconfiguration is happening on our network?
Thank you!
J
