Hi Skrao,
One thing that happens when you have a loop in a switched network is that you get a broadcast storm. Since Ethernet has not "Time To Live" field, if you have a loop in your network then the broadcasts get transmitted round the loop forever, saturating all the links.
Spanning Tree is a protocol designed to identify the loops and to cut them. There is not really any such thing as a "Spanning Tree loop", because Spanning Tree actually prevents loops. Do NOT disable it unless you are 110% sure that you have no physical loops in your network.
So, if you have a network that is looping, how do you identify where Spanning Tree is not working? It is made difficult by the fact that your network has stopped functioning correctly. The switches may be too busy to give you access to the management functions.
In most cases, the loop is due to a very recent change. Usually, creating a loop makes the network go down immediately, or exactly 90 second later. What has changed recently?
If you can access the management functions, then find out which VLAN has the traffic storm, and trace it out.
If your access switches have redundant uplinks, then disconnect them, leaving one uplink per access switch, and see if the storm stops. You should have uplinkfast running anyway, so this should not disrupt your traffic any more than it is already.
Know your network before the loop happens! In this case, prevention is really better than cure. If you can, put a broadcast limit on all your trunks. Enable BPDU guard on all your access ports.
Sniff the storming broadcasts, and look at the source MAC addresses. Use these brodcasts to identify the access switch involved.
Anyone else got any techniques they use to identify the loops?
Kevin Dorrell
Luxembourg
