Link to home
Start Free TrialLog in
Avatar of L Q
L Q

asked on

Troubleshooting a broadcast storm

Hi, I've noticed all our access switch interfce LEDs blinking rapidly which suggests there's a broadcast storm going on, the switches are all Cisco and mainly 2960X, there are two stacks formed with 4 switches each and three other standalone access switches together with six storage and server switches.

Any ideas on the best way to analyse and identify the cause (without disconnecting cables as this is a live environment).

Thanks.
Avatar of Nathan Hawkins
Nathan Hawkins
Flag of United States of America image

I wouldnt assume you have a broadcast storm going on. Windows is pretty chatty, that if you have several computers simply turned on, your switch is going to blink a lot. If you had a broadcast storm going on, those computers would be having a lot of difficulty in connecting to anything. So some basic tests you can conduct is/are going around and seeing if anyone is having any latency issues. Do some pings to the local servers. Anything on a LAN should return pings sub 10ms. Take a look at the interface statistics on the switch. Those might even say whether theres a packet storm going on. Look at the switch log for port reset or other related errors.

Like I said, I really doubt you have a broadcast storm going on.
Avatar of sharjeel ashraf
if you had a broadcast storm, users would be complaining about network outages or accessing resources, if no users are complaining then i don't think its a broadcast storm. more likely as Nathan has pointed out, clients on the network will cause data to go backwards and forwards between points. do you use WINS on any server or client settings.
Avatar of L Q
L Q

ASKER

Thank you for your response Nathan, some useful tips, I'll do some more checks, don't think WINS is used. Some users did complain of slow access to one application in particular but that was just one department.
Also, thanks for your input Sharjeel.
Broadcast can be caused due to many reasons. In your  case, could be spanning-tree loop. Capture the traffic using packet capture like Wireshark then look for mac addresses and trace them on your switch ( sh mac address-table add XXX). Note: This command may differ depending on switch IOS version

However, as mentioned by Nathan broadcast storms will disrupt the whole network but this is not happening in your case.
If all ports are blinking rapidly at the same time it could also be a multicast. Be sure you enable ip igmp snoop on all switches.  
You can also enable broadcast and multicast storm control on all interfaces, especially uplinks.
This question needs an answer!
Become an EE member today
7 DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform.
View membership options
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.