?
Solved

Cisco serial interface received broadcasts

Posted on 2011-04-19
9
Medium Priority
?
1,088 Views
Last Modified: 2012-05-11
I have a cisco 2811 ISR router and I am gotting alot of broadcasts on the interface. Does any body know how to find out where the broadcasts are comming from?
0
Comment
Question by:remus91
  • 5
  • 2
  • 2
9 Comments
 

Author Comment

by:remus91
ID: 35424772
the serial interface is connected to Sprint MPLS network and in less then a day I have received 6568 broadcasts on the interface.I have 3 other sites and those router have 0 bradcasts on the serial going to the same sprint MPLs network.
0
 
LVL 9

Expert Comment

by:DanJ
ID: 35424778
what type of protocol you're running on the serial ?
0
 
LVL 17

Expert Comment

by:surbabu140977
ID: 35424788
Can you paste your serial interface configuration?
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:remus91
ID: 35424813
Here is the serial interface configtion:
interface Serial0/0/0:0
 description T1 to Sprint MPLS
 ip address x.x.x.x 255.255.255.252
 ip wccp 61 redirect out
 ip wccp 62 redirect in
 no fair-queue
 no cdp enable
0
 

Author Comment

by:remus91
ID: 35424863
Here is the sh interface for se0/0/0:0. I cleared the counters at 8:30am today I have got over 700 broadcast on the interface already today.

WEB-GW1#sh int se 0/0/0:0
Serial0/0/0:0 is up, line protocol is up
  Hardware is GT96K Serial
  Description: T1 to Sprint MPLS
  Internet address is x.x.x.x/30
  MTU 1500 bytes, BW 1536 Kbit/sec, DLY 20000 usec,
     reliability 255/255, txload 99/255, rxload 23/255
  Encapsulation HDLC, loopback not set
  Keepalive set (10 sec)
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters 01:59:53
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 212
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 141000 bits/sec, 144 packets/sec
  5 minute output rate 600000 bits/sec, 169 packets/sec
     933008 packets input, 109708508 bytes, 0 no buffer
     Received 718 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     1079580 packets output, 477101977 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out

WEB-GW1#
0
 
LVL 17

Expert Comment

by:surbabu140977
ID: 35425034
I can only assume the following.

By default, Cisco routers does not forward IP packets addressed to any type of broadcast address - routers simply drops them or in case it’s ICMP echo to router’s directly connected broadcast subnet respond via echo reply to requestor.

Check for "ip-directed broadcast" command (by default it's disabled, so probably you won't find).  

Something is polling/attacking your router, but the packets are getting dropped. Sprint will not do. You can use "debug ip packet" command to see what's happening in serial. Use it with caution because the debug command might leave your router unresponsive.

Best,
0
 
LVL 9

Expert Comment

by:DanJ
ID: 35442306
Looking at the choices I would summarize them here:
1. using a debug ip packet command with and ACL. This would send packet information on the serial port.
2. using netflow to export traffic flows
3. using a packet copy from one interface to another. This is what I suggest, it's like SPAN feature on the switch but applied to the router. The nice thing about it you can use an ACL to filter what you need
http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_rawip.html

0
 

Accepted Solution

by:
remus91 earned 0 total points
ID: 35700426
I was able to find the answer to this issue. I was working with a tech from Sprint and found that the broadcasts on the serial interface was HDLC keepalives. We turned off keepalives on the serial interface and I stopped recieving broadcasts then turned the keepalives back on and started getting the broadcats again.
0
 

Author Closing Comment

by:remus91
ID: 35726893
Sprint helped me find the asnwer to this.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have seen some questions on problems with SSH/telnet access to Cisco routers that may occur despite the fact that from a PC connected to your LAN, Internet connectivity is in place and users can access Internet sites without any issues.  There are…
The Cisco RV042 router is a popular small network interfacing device that is often used as an internet gateway. Network administrators need to get at the management interface to make settings, change passwords, etc. This access is generally done usi…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question