Broadcast Storm. How to win?

Y

YaKot2014-12-27 21:34:15

linux

YaKot, 2014-12-27 21:34:15

There is a small network (10-15 machines). One of them, the video server, broadcasts a lot of floods. Worth Debian. Changed the network card - all the same. What could be the problem and how to quickly find it?

Reply

Answer the question

In order to leave comments, you need to log in

4 answer(s)

T

throughtheether, 2014-12-28
@throughtheether

There is a small network (10-15 machines). One of them, the video server, broadcasts a lot of floods.

What does it mean? How is it shown? Are the LEDs on the switches blinking? Is the network down? Why do you think this is a broadcast "storm"?

What could be the problem

What's the problem? Describe more specifically.
Generally speaking, in the case of unmanaged (which, as a rule, automatically means the absence of "intelligent" nuances like igmp snooping), multicast (multicast) traffic is processed in the same way as broadcast (broadcast). Therefore, it is worth considering the use of managed switches (although it will be more accurate to advise after receiving a traffic dump and a network diagram). To solve the problem of "excessive" multicast traffic (outgoing to ports that do not need it) using managed switches, you can use:
1) igmp snooping + igmp [snooping] querier
2) igmp snooping
static entry 3) multicast MAC address static entry, corresponding to the multicast group.
The most simple, understandable and recommended option is the first one.

And how can you quickly find it?

Connect your laptop/computer to a free switch port. Run wireshark/tshark/tcpdump, save the traffic dump, analyze it (for example, in wireshark - Statistics -> Endpoints), draw conclusions.

S

Sergey Petrikov, 2014-12-27
@RicoX

Show the contents of the flood package, otherwise you can guess for a long time from an incorrectly configured multicast to a software ring.

A

Alexey Cheremisin, 2014-12-28
@leahch

I suspect that the video server broadcasts in multicast, and you have not configured the igmp protocol on the switches, in particular, the igmp-snooping options. As a result, absolutely everyone (from a printer to an ip-phone) receives a multicast from the server, and not those who are subscribed to the mailing list. Replacing network cards will not help here, only setting up switches !!! (I'm talking as a developer of multicast video broadcasts)

V

Valentin, 2014-12-27
@vvpoloskin

In general, if the grid is built on blunt switches, the flood during multicast should be