Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 898
  • Last Modified:

WireShark log details

The VLAN's are know to have separate broadcast storm. We recently had a broadcast storm coming from one VLAN 500 and it seems to spreading to other vlan's as well. We have tried to capture the traffic through the wire-shark and I would like an explanation on the below log details :

 1054      436.694238      Rockwell_5e:65:b4      Broadcast      ARP      60      Who has 172.22.32.2?  Tell 0.0.0.0

The specific traffic was captured in my core switch port by connecting the laptop with wire shark. The other vlan's were also getting affected during the same time.

The guidance will be much appreciated.
0
anishantony
Asked:
anishantony
  • 3
  • 3
  • 2
  • +1
3 Solutions
 
nociSoftware EngineerCommented:
1054      436.694238      Rockwell_5e:65:b4      Broadcast      ARP      60      Who has 172.22.32.2?  Tell 0.0.0.0

This means that a system with the MAC address xx:xx:xx:5e:65:b4 (where  xxxxxx is the Rockwell prefix, (if you look at the RAW packet you will see the FULL mac address).
Which want to know which MAC address belongs to the system which uses IP address 172.22.32.2.

That system will respond directly to this system with an ARP  reply, using it's own MAC
mac address. The queer thing is that there is a 0.0.0.0 after the "Tell", there should be an IP address there.

You should be able to find where the system is by checking on which port the MAC address is injected into a switch [ using MAC/CAM table ] and follow it to the source.
It surely looks like some misconfigured system.
0
 
giltjrCommented:
Actually the 0.0.0.0 is used at the source IP address for a ARP probe.  Somebody is trying to see if the 172.22.32.2 address is in use.

Ref: http://wiki.wireshark.org/Gratuitous_ARP

Just search for 0.0.0.0.
0
 
nociSoftware EngineerCommented:
Thanks, didn't know that one.
0
New Tabletop Appliances Blow Competitors Away!

WatchGuard’s new T15, T35 and T55 tabletop UTMs provide the highest-performing security inspection in their class, allowing users at small offices, home offices and distributed enterprises to experience blazing-fast Internet speeds without sacrificing enterprise-grade security.

 
anishantonyAuthor Commented:
Apologize for the delay dear giltjr & noci.  

This rockwell switch was restarted at this time & I Understood from the GARP that this traffic was unnecessaryily flodding the vlan 500, just to check if 172.22.32.3 has an ip conflict with any other device. If so, will this happen each time the rockwell device is restarted, or is there a way to stop these packets from it.
0
 
giltjrCommented:
Is 172.22.32.3 the IP address of the Rockwell switch?  Which model switch is this?
0
 
anishantonyAuthor Commented:
It is a statix 8000 model.
0
 
giltjrCommented:
It looks like that model can have firmware updates.  Do you have the most recent update?  If not you may want to check and see if any of the updates may document resolving issues with GARP flooding.
0
 
anishantonyAuthor Commented:
The network is a mix of force10 c, s series switches and allenbradely, phonix switches. The statix 8000, phonix switches are taken care by a different team. Probably the firmware must be the root cause, I shall update it to the team. Thank you for your help.
0
 
rang1868Commented:
Hi anishantony,

Did yourproblem go away after the update of stratix firmware updates?
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 3
  • 3
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now