Re: Broadcast storm

Thanks Steve and Rob.

Doing packet capture now, so hopefully that'll help the next time it
pops up. One of the problems is that it's intermittent and a 24/7 storm.

This tells me that it's probably a virus or trojan somewhere as opposed
to being hardware related. (switch, bad cable, etc).

Thankfully I have several hundred Gig to write tcpdump files to and
no network meltdown . . . yet.

Steven Kurylo wrote:
> On Mon, Jul 21, 2008 at 2:29 PM, Lance Levsen <lance@catprint.ca> wrote:
>
>> Hey all.
>>
>> I've got a broadcast storm building on the network and I'm having a hard
>> time tracking the culprit down.
>>
>> Does anyone recommend any tools for tracking the SOB down?
>>
>
> wireshark and a switch with a monitor port. If you're switch doesn't
> have a monitor port, I suggest you have the sudden realization that
> you had booked this week off.
>
> What kind of broadcast is it? Ensuring a firewall is isolating it to
> lan segmet is good. Without knowing the broadcast type, taking nodes
> down one by one (or turn them all off and start back up one at a time)
> is an option to get things under control.
>
> --
> I'm interested in upgrading my 28.8 kilobaud internet connection to a
> 1.5 megabit fiberoptic T1 line. Will you be able to provide an IP
> router that's compatible with my token ring ethernet LAN configuration?
>
> To unsubscribe, send a message with the word "unsubscribe" (without the
> quotes) in the body to linux-request@slg.org
> Archives are at http://list.slg.org/
>
Received on Mon Jul 21 16:21:58 2008