Solved

WireShark log details

Posted on 2012-03-23
9
850 Views
Last Modified: 2012-05-17
The VLAN's are know to have separate broadcast storm. We recently had a broadcast storm coming from one VLAN 500 and it seems to spreading to other vlan's as well. We have tried to capture the traffic through the wire-shark and I would like an explanation on the below log details :

 1054      436.694238      Rockwell_5e:65:b4      Broadcast      ARP      60      Who has 172.22.32.2?  Tell 0.0.0.0

The specific traffic was captured in my core switch port by connecting the laptop with wire shark. The other vlan's were also getting affected during the same time.

The guidance will be much appreciated.
0
Comment
Question by:anishantony
  • 3
  • 3
  • 2
  • +1
9 Comments
 
LVL 40

Assisted Solution

by:noci
noci earned 75 total points
ID: 37759533
1054      436.694238      Rockwell_5e:65:b4      Broadcast      ARP      60      Who has 172.22.32.2?  Tell 0.0.0.0

This means that a system with the MAC address xx:xx:xx:5e:65:b4 (where  xxxxxx is the Rockwell prefix, (if you look at the RAW packet you will see the FULL mac address).
Which want to know which MAC address belongs to the system which uses IP address 172.22.32.2.

That system will respond directly to this system with an ARP  reply, using it's own MAC
mac address. The queer thing is that there is a 0.0.0.0 after the "Tell", there should be an IP address there.

You should be able to find where the system is by checking on which port the MAC address is injected into a switch [ using MAC/CAM table ] and follow it to the source.
It surely looks like some misconfigured system.
0
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 425 total points
ID: 37759713
Actually the 0.0.0.0 is used at the source IP address for a ARP probe.  Somebody is trying to see if the 172.22.32.2 address is in use.

Ref: http://wiki.wireshark.org/Gratuitous_ARP

Just search for 0.0.0.0.
0
 
LVL 40

Expert Comment

by:noci
ID: 37759895
Thanks, didn't know that one.
0
Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

 

Author Comment

by:anishantony
ID: 37783235
Apologize for the delay dear giltjr & noci.  

This rockwell switch was restarted at this time & I Understood from the GARP that this traffic was unnecessaryily flodding the vlan 500, just to check if 172.22.32.3 has an ip conflict with any other device. If so, will this happen each time the rockwell device is restarted, or is there a way to stop these packets from it.
0
 
LVL 57

Expert Comment

by:giltjr
ID: 37783737
Is 172.22.32.3 the IP address of the Rockwell switch?  Which model switch is this?
0
 

Author Comment

by:anishantony
ID: 37800978
It is a statix 8000 model.
0
 
LVL 57

Accepted Solution

by:
giltjr earned 425 total points
ID: 37801534
It looks like that model can have firmware updates.  Do you have the most recent update?  If not you may want to check and see if any of the updates may document resolving issues with GARP flooding.
0
 

Author Comment

by:anishantony
ID: 37807510
The network is a mix of force10 c, s series switches and allenbradely, phonix switches. The statix 8000, phonix switches are taken care by a different team. Probably the firmware must be the root cause, I shall update it to the team. Thank you for your help.
0
 

Expert Comment

by:rang1868
ID: 37983133
Hi anishantony,

Did yourproblem go away after the update of stratix firmware updates?
0

Featured Post

Save the day with this special offer from ATEN!

Save 30% on the CV211 using promo code EXPERTS30 now through April 30th. The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Force a WIFI client onto a specific access point 7 63
assignment of laptops - risks 6 83
NTP configuration on Cisco switch 3 35
Boot Camp 3 55
David Varnum recently wrote up his impressions of PRTG, based on a presentation by my colleague Christian at Tech Field Day at VMworld in Barcelona. Thanks David, for your detailed and honest evaluation!
I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

679 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question