Comware

I need help in detecting what is really causing the above. We got two building connected to each other via fiber link. Two gigabit port trucked and at certain days and time the link will go off for just a few seconds before it re-established. It started last two weeks and has been happening on the same day's at the same time.

To try and capture the traffic I have got a machine connected to one of the switch port running Omnipeek and monitoring the Trunk  just filtering to capture only broadcast which I assume is causing the link to go off.

Am attaching herewith the alert log from one of the switch. There is nothing on the alert log page of the other switch so I assume the cause is from this switch

Is there a particular traffic that I should monitor as well as I have gone through the captures and haven't notice a broadcast traffic that can cause the link to go off at that particular time the link goes off as shown on the alert log

Thanks for the help

I think I might has solved this. It hasnt happen since I enable spanning tree to some newly installed switch and updating the firmawares of all my switches. Will have to wait and see :)

HTH

Hello,

I'd be curious if you resolved your issue.

I don't think we've encountered the same issue, it is somewhat similar.  I've had many times in the past where excessive broadcasts were occuring across my entire network, bringing down the entire company.  I was after a time able to trace the source of the broadcast back to a backup job that was in the verify process from a MS SQL server dumping transaction log backups to a DataDomain.

My issue seemed to resolve it's self when we virtualized our SQL server.

I live every day in fear that the issue will return so I'm trying to stay up on it.

Thanks

This could be a case of so called "unicast flooding". It happens e.g. when you connect a server to the network with two links that are "teamed", "bundled" or whatever the driver calls it. An ARP request to the servers IP is resolved to only one of the two MAC addresses. So packets to this server will be addressed to this MAC. If the server does not send packets *from* this MAC for more than 2 Minutes - which could easily happen if packets are sent through the other MAC only - the switch will forget (age out) this MAC address and subsequent packets *to* this MAC will be flooded, i.e. sent out all ports like broadcasts.

I've seen more than one network die from unicast floods. This can be detected and tracked quite easily with a sniffer, but you have to think of this possible issue when your network comes to a screeching halt.