WireShark log details

The VLAN's are know to have separate broadcast storm. We recently had a broadcast storm coming from one VLAN 500 and it seems to spreading to other vlan's as well. We have tried to capture the traffic through the wire-shark and I would like an explanation on the below log details :

 1054      436.694238      Rockwell_5e:65:b4      Broadcast      ARP      60      Who has 172.22.32.2?  Tell 0.0.0.0

The specific traffic was captured in my core switch port by connecting the laptop with wire shark. The other vlan's were also getting affected during the same time.

The guidance will be much appreciated.
anishantonyAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

nociSoftware EngineerCommented:
1054      436.694238      Rockwell_5e:65:b4      Broadcast      ARP      60      Who has 172.22.32.2?  Tell 0.0.0.0

This means that a system with the MAC address xx:xx:xx:5e:65:b4 (where  xxxxxx is the Rockwell prefix, (if you look at the RAW packet you will see the FULL mac address).
Which want to know which MAC address belongs to the system which uses IP address 172.22.32.2.

That system will respond directly to this system with an ARP  reply, using it's own MAC
mac address. The queer thing is that there is a 0.0.0.0 after the "Tell", there should be an IP address there.

You should be able to find where the system is by checking on which port the MAC address is injected into a switch [ using MAC/CAM table ] and follow it to the source.
It surely looks like some misconfigured system.
0
giltjrCommented:
Actually the 0.0.0.0 is used at the source IP address for a ARP probe.  Somebody is trying to see if the 172.22.32.2 address is in use.

Ref: http://wiki.wireshark.org/Gratuitous_ARP

Just search for 0.0.0.0.
0
nociSoftware EngineerCommented:
Thanks, didn't know that one.
0
Check Out How Miercom Evaluates Wi-Fi Security!

It's not just about Wi-Fi connectivity anymore. A wireless security breach can cost your business large amounts of time, trouble, and expense. Plus, hear first-hand from Miercom on how WatchGuard's Wi-Fi security stacks up against the competition plus a LIVE demo!

anishantonyAuthor Commented:
Apologize for the delay dear giltjr & noci.  

This rockwell switch was restarted at this time & I Understood from the GARP that this traffic was unnecessaryily flodding the vlan 500, just to check if 172.22.32.3 has an ip conflict with any other device. If so, will this happen each time the rockwell device is restarted, or is there a way to stop these packets from it.
0
giltjrCommented:
Is 172.22.32.3 the IP address of the Rockwell switch?  Which model switch is this?
0
anishantonyAuthor Commented:
It is a statix 8000 model.
0
giltjrCommented:
It looks like that model can have firmware updates.  Do you have the most recent update?  If not you may want to check and see if any of the updates may document resolving issues with GARP flooding.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
anishantonyAuthor Commented:
The network is a mix of force10 c, s series switches and allenbradely, phonix switches. The statix 8000, phonix switches are taken care by a different team. Probably the firmware must be the root cause, I shall update it to the team. Thank you for your help.
0
rang1868Commented:
Hi anishantony,

Did yourproblem go away after the update of stratix firmware updates?
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Management

From novice to tech pro — start learning today.