|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Multicast storm
Has anyone ever seen that only one bogus packet caused multicast storm in a vlan environment? In the following example, the first packet with src/dest MAC addresses 72:3a:20:63:6f:9/41:2d:63:6f:6c:6f caused other machines in the network generated nearly 10Mbps traffic towards some multicast MAC addresses for few minutes in a 10/100 switched vlan. Is there any way to prevent it or let those "amplify" devices not to re-send them? 19:27:07.080000 72:3a:20:63:6f:9 41:2d:63:6f:6c:6f 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 570133376:570134836(1460) ack 13531 58 win 8760 (DF) 19:27:07.080000 0:0:f8:5:60:8d 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.080000 0:e0:21:1:0:b1 1:0:5e:42:63:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.080000 0:a0:24:23:39:82 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:a0:24:2a:5a:33 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:60:97:e2:51:24 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:a0:24:95:7a:34 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:0:f8:5:60:8d 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:a0:24:7:30:3d 1:0:5e:5:48:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:a0:24:95:7a:34 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:0:f8:5:60:8d 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.090000 0:60:97:e2:51:24 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:60:97:e2:51:24 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:60:97:e2:51:24 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:e0:21:1:0:b1 1:0:5e:42:63:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:a0:24:7:30:3d 1:0:5e:5:48:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:a0:24:95:7a:34 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:a0:24:2a:5a:33 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:60:97:e2:51:8a 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.100000 0:a0:24:2a:5a:33 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.110000 0:a0:24:95:7a:34 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) 19:27:07.110000 0:a0:24:7:30:3d 1:0:5e:5:48:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 win 8760 (DF) <snip, a 7 MB file> ------ Wilson Chu AboveNet Communications http://www.above.net
|