Solved

WireShark log details

Posted on 2012-03-23
9
866 Views
Last Modified: 2012-05-17
The VLAN's are know to have separate broadcast storm. We recently had a broadcast storm coming from one VLAN 500 and it seems to spreading to other vlan's as well. We have tried to capture the traffic through the wire-shark and I would like an explanation on the below log details :

 1054      436.694238      Rockwell_5e:65:b4      Broadcast      ARP      60      Who has 172.22.32.2?  Tell 0.0.0.0

The specific traffic was captured in my core switch port by connecting the laptop with wire shark. The other vlan's were also getting affected during the same time.

The guidance will be much appreciated.
0
Comment
Question by:anishantony
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
  • +1
9 Comments
 
LVL 40

Assisted Solution

by:noci
noci earned 75 total points
ID: 37759533
1054      436.694238      Rockwell_5e:65:b4      Broadcast      ARP      60      Who has 172.22.32.2?  Tell 0.0.0.0

This means that a system with the MAC address xx:xx:xx:5e:65:b4 (where  xxxxxx is the Rockwell prefix, (if you look at the RAW packet you will see the FULL mac address).
Which want to know which MAC address belongs to the system which uses IP address 172.22.32.2.

That system will respond directly to this system with an ARP  reply, using it's own MAC
mac address. The queer thing is that there is a 0.0.0.0 after the "Tell", there should be an IP address there.

You should be able to find where the system is by checking on which port the MAC address is injected into a switch [ using MAC/CAM table ] and follow it to the source.
It surely looks like some misconfigured system.
0
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 425 total points
ID: 37759713
Actually the 0.0.0.0 is used at the source IP address for a ARP probe.  Somebody is trying to see if the 172.22.32.2 address is in use.

Ref: http://wiki.wireshark.org/Gratuitous_ARP

Just search for 0.0.0.0.
0
 
LVL 40

Expert Comment

by:noci
ID: 37759895
Thanks, didn't know that one.
0
Webinar: MongoDB® Index Types

Join Percona’s Senior Technical Services Engineer, Adamo Tonete as he presents “MongoDB Index Types, How, When and Where Should They be Used?” on Wednesday, July 12, 2017 at 11:00 am PDT / 2:00 pm EDT (UTC-7).

 

Author Comment

by:anishantony
ID: 37783235
Apologize for the delay dear giltjr & noci.  

This rockwell switch was restarted at this time & I Understood from the GARP that this traffic was unnecessaryily flodding the vlan 500, just to check if 172.22.32.3 has an ip conflict with any other device. If so, will this happen each time the rockwell device is restarted, or is there a way to stop these packets from it.
0
 
LVL 57

Expert Comment

by:giltjr
ID: 37783737
Is 172.22.32.3 the IP address of the Rockwell switch?  Which model switch is this?
0
 

Author Comment

by:anishantony
ID: 37800978
It is a statix 8000 model.
0
 
LVL 57

Accepted Solution

by:
giltjr earned 425 total points
ID: 37801534
It looks like that model can have firmware updates.  Do you have the most recent update?  If not you may want to check and see if any of the updates may document resolving issues with GARP flooding.
0
 

Author Comment

by:anishantony
ID: 37807510
The network is a mix of force10 c, s series switches and allenbradely, phonix switches. The statix 8000, phonix switches are taken care by a different team. Probably the firmware must be the root cause, I shall update it to the team. Thank you for your help.
0
 

Expert Comment

by:rang1868
ID: 37983133
Hi anishantony,

Did yourproblem go away after the update of stratix firmware updates?
0

Featured Post

IoT Devices - Fast, Cheap or Secure…Pick Two

The IoT market is growing at a rapid pace and manufacturers are under pressure to quickly provide new products. Can you be sure that your devices do what they're supposed to do, while still being secure?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
For many of us, the  holiday season kindles the natural urge to give back to our friends, family members and communities. While it's easy for friends to notice the impact of such deeds, understanding the contributions of businesses and enterprises i…
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…
Suggested Courses

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question