[Webinar] Streamline your web hosting managementRegister Today

x
?
Solved

WireShark log details

Posted on 2012-03-23
9
Medium Priority
?
910 Views
Last Modified: 2012-05-17
The VLAN's are know to have separate broadcast storm. We recently had a broadcast storm coming from one VLAN 500 and it seems to spreading to other vlan's as well. We have tried to capture the traffic through the wire-shark and I would like an explanation on the below log details :

 1054      436.694238      Rockwell_5e:65:b4      Broadcast      ARP      60      Who has 172.22.32.2?  Tell 0.0.0.0

The specific traffic was captured in my core switch port by connecting the laptop with wire shark. The other vlan's were also getting affected during the same time.

The guidance will be much appreciated.
0
Comment
Question by:anishantony
  • 3
  • 3
  • 2
  • +1
9 Comments
 
LVL 41

Assisted Solution

by:noci
noci earned 225 total points
ID: 37759533
1054      436.694238      Rockwell_5e:65:b4      Broadcast      ARP      60      Who has 172.22.32.2?  Tell 0.0.0.0

This means that a system with the MAC address xx:xx:xx:5e:65:b4 (where  xxxxxx is the Rockwell prefix, (if you look at the RAW packet you will see the FULL mac address).
Which want to know which MAC address belongs to the system which uses IP address 172.22.32.2.

That system will respond directly to this system with an ARP  reply, using it's own MAC
mac address. The queer thing is that there is a 0.0.0.0 after the "Tell", there should be an IP address there.

You should be able to find where the system is by checking on which port the MAC address is injected into a switch [ using MAC/CAM table ] and follow it to the source.
It surely looks like some misconfigured system.
0
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 1275 total points
ID: 37759713
Actually the 0.0.0.0 is used at the source IP address for a ARP probe.  Somebody is trying to see if the 172.22.32.2 address is in use.

Ref: http://wiki.wireshark.org/Gratuitous_ARP

Just search for 0.0.0.0.
0
 
LVL 41

Expert Comment

by:noci
ID: 37759895
Thanks, didn't know that one.
0
Never miss a deadline with monday.com

The revolutionary project management tool is here!   Plan visually with a single glance and make sure your projects get done.

 

Author Comment

by:anishantony
ID: 37783235
Apologize for the delay dear giltjr & noci.  

This rockwell switch was restarted at this time & I Understood from the GARP that this traffic was unnecessaryily flodding the vlan 500, just to check if 172.22.32.3 has an ip conflict with any other device. If so, will this happen each time the rockwell device is restarted, or is there a way to stop these packets from it.
0
 
LVL 57

Expert Comment

by:giltjr
ID: 37783737
Is 172.22.32.3 the IP address of the Rockwell switch?  Which model switch is this?
0
 

Author Comment

by:anishantony
ID: 37800978
It is a statix 8000 model.
0
 
LVL 57

Accepted Solution

by:
giltjr earned 1275 total points
ID: 37801534
It looks like that model can have firmware updates.  Do you have the most recent update?  If not you may want to check and see if any of the updates may document resolving issues with GARP flooding.
0
 

Author Comment

by:anishantony
ID: 37807510
The network is a mix of force10 c, s series switches and allenbradely, phonix switches. The statix 8000, phonix switches are taken care by a different team. Probably the firmware must be the root cause, I shall update it to the team. Thank you for your help.
0
 

Expert Comment

by:rang1868
ID: 37983133
Hi anishantony,

Did yourproblem go away after the update of stratix firmware updates?
0

Featured Post

SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
LinkedIn blogging is great for networking, building up an audience, and expanding your influence as well. However, if you want to achieve these results, you need to work really hard to make your post worth liking and sharing. Here are 4 tips that ca…
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

590 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question