4 Replies Latest reply on Jul 19, 2017 12:50 PM by supportdiehard

    Broadcast storm

      I am trying to work out the easiest way to monitor and pinpoint where a broadcast storm is generating from as we believe we have one occuring and I want to do this via Orion NPM as we've just installed a demo and its a good time to prove its worth! :-)

      I've had a search but everytime I flick to page 2 it tells me that the page can't be found (on the search results)

       

      thanks in advance

        • Re: Broadcast storm
          Donald_Francis

          A broadcast storm at this stage in networking is normally caused by a loop in the network.  That is something that normally is very hard to track down.  To be honest I do not know how Orion can help you do that especially keeping in mind that if you have something like that going on monitoring traffic will probably be getting dropped anyway.

          So outside of catching a high CPU on a switch (but normally all of them on the same broadcast domain will do that) I am not sure what you can do.  Although having Orion alert on a high CPU could let you know that one was ocurring.

            • Re: Broadcast storm

              I had a feeling that would be the answer - thank you for the response

              unfortunately we know what switch it is occuring on so I think my next move is to run the engineers toolset switch port mapper and start checking to see if duplicate macs etc exist

              1 of 1 people found this helpful
                • Re: Broadcast storm
                  ecornwell

                  In the past we narrowed down things like this by looking at all the ports.  We would see the same amount of traffic on the ports but one would always be send and the others receive.  That's one reason I was working to get a page that shows all interfaces.  There is a thread about migrating asp to asp.net that has the code in it.

              • Re: Broadcast storm
                supportdiehard

                You would need something like our User Device Tracking and have all your ports monitored so if something got plugged in by accident you could see it.  You would also need syslog data showing the broadcast from Spanning Tree.  Another tool of ours you could use is Network Topology Mapper which would map out what interfaces are connected to what through SNMP and ICMP