• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 416
  • Last Modified:

Strange...3Com SuperStack 3870 acting like a hub

I've got several 3Com 3870 Gigabit switches and some weird activity on the network. All are 48 port switches as opposed to the 24 port models.

We have two of these switches connected with a matrix cable, thus binding them into one switch. The second of the two has a fiber module in it and it connects to another 3870 switch of course with a fiber module in it. There is another 3870 connected to this one via a Cat 5e cable to upstairs.

Most of our servers are connected to the main switches that are bound by the matrix cable. Many of our users also connect to this switch.

The weird thing is I can see traffic on the last switch, two daisy chains away which should never leave the first switch. This traffic is NOT broadcast traffic either which is the confusing part. Two machines/servers connected to the same switch with IP traffic with a direct source and a direct destination should NOT be transmitted across the fiber and definitely not up to the third switch over the cat 5e cable to upstairs.

I have all but one wireless router turned off and Spanning Tree and Broadcast Storm control is enabled.

I'm losing my mind. Please help..
0
travisryan
Asked:
travisryan
  • 4
  • 3
1 Solution
 
Chris GralikeSpecialistCommented:
Do you have the spanning-tree protocol enabled maybe?
0
 
Chris GralikeSpecialistCommented:
btw, the last one isnt because i didnt read your post, but more (link up a laptop) and sniff the traffic ;)
0
 
travisryanAuthor Commented:
Yes, it is enabled and I only know what I've typed above because I tried hooking up my laptop several times to different points in the network using Wireshark and eEye's Iris network scanner.

I just have no idea why it would let me see traffic at an endpoint switch on the network when two machines on an entirely different switch are showing packets solely for each other on this outer switch.
0
Improved Protection from Phishing Attacks

WatchGuard DNSWatch reduces malware infections by detecting and blocking malicious DNS requests, improving your ability to protect employees from phishing attacks. Learn more about our newest service included in Total Security Suite today!

 
Chris GralikeSpecialistCommented:
Did wireshark show you what type of traffic was comming over the ports on the outer switch?
0
 
Chris GralikeSpecialistCommented:
Could you copy paste it (if you got any that is)
0
 
travisryanAuthor Commented:
I don't have it with me now, but alot of it was just traffic between our Windows 2003 NAS servers for the File replication, as well as just normal accessing of windows shares/services for users.
0
 
travisryanAuthor Commented:
Ok, just an update for anyone who cares.

The two windows 2003 NAS servers have dual NICs in them and the ability to do teaming with a Broadcom utility. We had removed one of the NICs from the team when trying to figure out what was happening with this problem months ago. After I removed the teaming and went back to just a single NIC my network was slient again. I think it might have been some check box option on the network settings for that adapter that for some reason had a certain kind of multicast. Very weird, but now all is well.
0
 
ee_autoCommented:
Question PAQ'd, 500 points refunded, and stored in the solution database.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Introducing Cloud Class® training courses

Tech changes fast. You can learn faster. That’s why we’re bringing professional training courses to Experts Exchange. With a subscription, you can access all the Cloud Class® courses to expand your education, prep for certifications, and get top-notch instructions.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now