Troubleshooting a broadcast storm

L Q
L Q used Ask the Experts™
on
Hi, I've noticed all our access switch interfce LEDs blinking rapidly which suggests there's a broadcast storm going on, the switches are all Cisco and mainly 2960X, there are two stacks formed with 4 switches each and three other standalone access switches together with six storage and server switches.

Any ideas on the best way to analyse and identify the cause (without disconnecting cables as this is a live environment).

Thanks.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Nathan HawkinsTechnical Lead - Network Security

Commented:
I wouldnt assume you have a broadcast storm going on. Windows is pretty chatty, that if you have several computers simply turned on, your switch is going to blink a lot. If you had a broadcast storm going on, those computers would be having a lot of difficulty in connecting to anything. So some basic tests you can conduct is/are going around and seeing if anyone is having any latency issues. Do some pings to the local servers. Anything on a LAN should return pings sub 10ms. Take a look at the interface statistics on the switch. Those might even say whether theres a packet storm going on. Look at the switch log for port reset or other related errors.

Like I said, I really doubt you have a broadcast storm going on.
sharjeel ashrafSenior Network Engineer

Commented:
if you had a broadcast storm, users would be complaining about network outages or accessing resources, if no users are complaining then i don't think its a broadcast storm. more likely as Nathan has pointed out, clients on the network will cause data to go backwards and forwards between points. do you use WINS on any server or client settings.
L Q

Author

Commented:
Thank you for your response Nathan, some useful tips, I'll do some more checks, don't think WINS is used. Some users did complain of slow access to one application in particular but that was just one department.
Also, thanks for your input Sharjeel.

Commented:
Broadcast can be caused due to many reasons. In your  case, could be spanning-tree loop. Capture the traffic using packet capture like Wireshark then look for mac addresses and trace them on your switch ( sh mac address-table add XXX). Note: This command may differ depending on switch IOS version

However, as mentioned by Nathan broadcast storms will disrupt the whole network but this is not happening in your case.
Les MooreSr. Systems Engineer
Top Expert 2008

Commented:
If all ports are blinking rapidly at the same time it could also be a multicast. Be sure you enable ip igmp snoop on all switches.  
You can also enable broadcast and multicast storm control on all interfaces, especially uplinks.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial