How to find a loop in a local network?

Question

Computer networks

A local network was built in the student dormitory based on the Mikrotik RB750 router and many unmanaged switches. From the local ports of the router (numbers 2, 3, 4, 5), cables diverge across the floors to 16- and 24-port unmanaged switches, and from them to small 5-port switches in the rooms. Here and there in the rooms there are routers configured in the "router" mode (its own subnet).
Everything worked fine, and today an annoying message appeared in the logs: eth4-local: excessive broadcasts/multicasts, probably a loop. The network lies, but the remote control of the router works. If you programmatically disable the subnet connected to the 4th connector, then everything starts working normally for the rest.
I tried using the standard Mikrotik utilities (/Tools) to find something, not really understanding what to look for. But still, I found that when the problematic network is turned on, Packet Snifer starts detecting ipv6 addresses on the network, and some addresses are somehow incomplete.
What, you still have to go and pull the wires in series? Probably one of the switches went crazy? Or maybe one of the users is playing around ?, but how to identify it, with what tools?

Answer 1

1. try to divide the network into vlans. the router may not be able to handle a lot of broad- and mulicasts packets
*my guess is
2. disconnect eth4 from the router and connect directly to that network, run wireshark/tcpdump and see who "broadcasts a lot" there =)

Answer 2

In your case, with such a set of unmanaged switches, you are your own evil Pinocchio. Do not take too close to yourself. Just another option but to go and

pull consistently

you do not have with such a network structure. Here, like your switch, you could start to go crazy, and one of the users. Not a fact, of course, but you can try to dump the traffic from the 4th port of your Mikrotik and smoke it for a huge amount of broadcast traffic. You can also, as an option, bypass each switch that you have on the network and try to visually determine the source of the loop. If the switch is the culprit, in most cases they turn into a typical New Year's garland - the activity indicator of all ports lights up almost without interruptions (if, of course, it can blink at all when there is traffic on the port :-)). Unfortunately, I do not have much knowledge in eliminating such problems. I hope that one of the network gurus will tell you a better solution to the problem if they exist.
And as soon as possible, replace your "soap dishes" with something more capable. At least the same D-Link. For they know how to VLAN, and in your case it is a necessary thing.

Answer 3

How to find a loop in a local network?

unmanaged switches,

You don't even know if there really is an L2 loop. It may well be that somewhere behind eth4 there is a DHCP server that distributes incorrect settings to all clients (using broadcast packets). For example, a room router was stuck in the wrong port.

But still, I found that when the problematic network is turned on, Packet Snifer starts detecting ipv6 addresses on the network, and some addresses are somehow incomplete.

Please provide an example (addresses, traffic dump).

What, you still have to go and pull the wires in series?

Yes, you will.

Probably one of the switches went crazy?

Possibly, but in order to confirm this, you will have to "go and pull the wires in series."
I think it's already clear that you should think about purchasing normal (managed) switches? They cost something, about 3000 for 16 ports ( example ). Until then, you can try to minimize network instability by limiting broadcast / multicast packets, disabling other people's DHCP servers on the central router (as I understand it, both of these tasks on Mikrotik, albeit using a creative approach, are solvable)

Answer 4

A fried network card can do such crap.
By the way, it's easy to check the presence of the left DHCP - turn it off on the micro and try to get the address.
Perhaps in your case it will be easier to separate the subnets from each other - pull them out of the bridge.

Answer 5

1) Without managed switches, the search for a loop is possible only by sequentially pulling out the wires.
2) Old managed D-Link DES-3026 can be exchanged for beer from many providers. On Avito are sold for 1t.r. and cheaper, i.e. for <40r. per port. But they can be buggy.
3) Of the new switches, Mikrotik CRS125-24G-1S-IN (less than 400 rubles per port) and low-port RB260GS have a good price - http://mikrotik.rf/katalog/oborudovanie-mikrotik-k...

Answer 6

I also somehow built a LAN in a hostel, there were 70 computers then, I remember what a shock I was when I "turned off the network segment", and it continued to work as if nothing had happened :) Then I found out that that segment was connected twice :) But this is a problem did not cause, routers now even the cheapest ones are able to build arp tables and steer the routing, so it only duplicated the connection, but did not flood anything. Here, as written above, you will have to use the scientific "poke" method to check who has a problem, most likely, as they wrote above, either DHCP or fried equipment.

Answer 7

I myself realized that without managed switches, I would have to run a lot to the object and without result.
This morning I turned on (remotely, via winbox) the port of the router on which there was a loop yesterday, but there is no longer a loop! But anyway, I went with a laptop and made sure that everything worked. Calmed down. At lunch, I remotely looked at the logs of the router - again a loop. For an hour, about 20 messages about the loop, then stopped. Maybe someone is in a bad mood, took and stuck both ends of the patch cord into the room switch, then pulled it out. And I run around.
I took a closer look at the D-Link DES-1100-16(24) managed switches. Who will say what?