8 Replies Latest reply: Apr 18, 2012 7:51 AM by Nilesh W RSS

    Network issue

    Nilesh W

      Hi all,

       

      I was facing network issues last week due to One PC.Network went down just because of  one PC.

       

      After disconnecting PC, network got stable.I dont know why this PC hamper the network.

       

      Can anybody please let me know what precaution or configuration need to be done on switches so that this type of issue will not come again.

       

      Thanks in advance.

       

      Nilesh

        • 1. Re: Network issue
          CiscoLoco - CCNP

          You could look into broadcast storm control to limit the broadcast packets the host can send into your network.

           

          ex. storm-control broadcast level 10.00

          • 2. Re: Network issue
            macd

            sounds like that PC was/is infected by a root kit which might be generating a lot of traffic. Storm control and making sure the port never forms a trunk might be helpfull options

            • 3. Re: Network issue
              Nilesh W

              Hi ciscoLoco and macd,

               

              Thanks for your reply.

               

              can we set alers when broadcast packets reached thresold.what level we can set as per standard.  

              • 4. Re: Network issue
                Alex Kieser

                You'd want to look at errdisable and recovery states if someone calls you saying port is disabled you can check the recovery to see if it disabled the port because of the violation.

                • 5. Re: Network issue
                  Jared

                  Actually, what I would do is I would stick the PC on a stand alone hub that is completely isolated and not plugged into anything and then sniff the traffic as to what it is doing.  As macd stated, it could be an infected PC or it could be that it was running an app that would have similar affects on network traffic.  I have seen PC's intentionally running various Hacking tools that also would bring the network to a crawl.  You'd have to check out the PC or sniff the traffic or even both to find out the why behind the behavior.

                  • 6. Re: Network issue
                    Nilesh W

                    Thanks Jared .

                     

                    Can we set SNMP traps or alerts when bradcast level threshold reached on interface.

                    • 7. Re: Network issue
                      Jimmy Sands

                      Alot of things could cause this, once I found a malfunctioning NIC broadcasting frames out at too high a rate

                       

                      I was called out to a site, intermittent internet, 2 hours later, packet sniffer showed me one IP that was sending out 800 SSDP ackets per second, traced MAC down, disconnected PC, network stabilized.    Sniffer showed nothing out of ordinary, plugged PC back in, network went crazy again, returned NIC.  It was hooked up to an unmangaged switch and that uplinked to an extreme switch.

                      • 8. Re: Network issue
                        Nilesh W

                        Jimmy , I agreed unmanagable switches creates huge braodcast if loop occures but We dont have unmanagable switch in our network.

                        , if network storm happens in managable switch then bradcast thresold level we can set.

                         

                        Alternate can we have tool or traps where we can manage such situation.