Strange Strange Brodcast

[alsayed]

hello

i cleared the counter for my gig interface connected to DS.and i watch my strange brodcast:

brodcast incresed every second i issue sh interface gig0/1

92601

185392

271123

314004

335597

364242

385654

1078788

2935007

plz help to overcome

[Edison Ortiz]

What is DS ?

Can you post the output from show interface g0/1 ?

[alsayed]

hello edison!

ds:its distribution:

SW#sh interfaces gigabitEthernet 0/1

Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Full-duplex, 1000Mb/s

Link type is autonegotiation, media type is SX

output flow-control is off, input flow-control is off

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:00, output 00:00:03, output hang never

Last clearing of "show interface" counters 03:59:45

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue :0/40 (size/max)

5 minute input rate 7006000 bits/sec, 7053 packets/sec

5 minute ouxtput rate 0 bits/sec, 0 packets/sec

102537443 packets input, 4241617996 bytes, 0 no buffer

Received 102361096 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 102195392 multicast, 0 pause input

0 input packets with dribble condition detected

4618 packets output, 862882 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier, 0 PAUSE output

0 output buffer failures, 0 output buffers swapped out

[alsayed]

edison

have a look to the Brodcast now:

Received 118415322 broadcasts.help me to Kill This Brodcast

[Edison Ortiz]

wow, you have a ton of input traffic with no output traffic.

Did you try telneting to the device connected on G0/1 ? What type of device is connected to G0/1 ?

It looks like you have a virus.

[alsayed]

hello!

gig0/1 Connected to Distribution-Switch.help

[Edison Ortiz]

Did you telnet to this switch and check the port counters to identify which switchport is the one sending the most traffic ?

[alsayed]

do i need to check every port by sh interface fx/y

10xs

[mheusing]

Hi,

The first question coming to my mind: what is causing the broadcast traffic? Can you use a packet analyzer like Wireshark to record the packets utilizing a SPAN port?

This should help to identify the cause of the broadcast packets and thus maybe allow you to stop it at the origin.

I know some applications use broadcast to distribute data, which could explain the observed behaviour.

Regards, Martin

[alsayed]

in the wireshake gives us Ipv6 traffic try to join Multicast group.we dont have ipv6 enabled

[RouterTech1]

so shut off the ipv6 on the clients that are trying to join... Vista has ipv6 enabled by default.

[mheusing]

Which source MAC address is seen? Track the source MAC address(es) to the switch port(s) connecting the end device(s). In some operating systems IPv6 is turned on by default (or misconfiguration by admins).

Once you know the end device you need to check the operating system settings. In MS you could simply disable the protocol for the network card in the LAN Properties Tab.

Regards, Martin

[alsayed]

the Source is Empty

[mheusing]

Empty? you mean all zeros as source MAC address? A standard ethernet frame has to have a source MAC and a destination MAC. Can you attach a small sample of collected packets in a zipped file?

Regards, Martin

[alsayed]

yeh its coming from the Distribution the IP of the interface Vlan 12.12.12.3?helpppppppppppppp.what happend?