0

I'm using 2 Cisco Catalyst 3850 switches (Sw1, Sw2) and 3 Cisco Nexus switches (Sw3, Sw4, Sw5) as part of my internal network, connected in the manner below (A, B, C, D, E, F represent 10G ports, i.e. A on Sw1 is connected to A on Sw3). The switches were setup by someone else, and I believe they simply used them as they are without any configuration. Basically, Sw1 and Sw2 are connected to Sw3 and Sw4, and then Sw3 and Sw4 are connected to Sw5, which is then connected to an outside network.

Sw1      Sw3         Sw5
----     --------    ----
A  B     A  C  E     E  F

Sw2      Sw4
----     --------  
C  D     B  D  F

Currently, Sw1, Sw2 are also connected to servers and other equipment via their 1G ports. The intention is such that all servers and equipment can talk to each other and the outside network.

What I observed was every few minutes, there would be a burst of broadcast packets (e.g. DHCP Discovery, FIP, ARP, DNS) at about 60K-100K in an instant, and the source MAC addresses came from 2 different MAC addresses.

However, when I removed the connections B, D and F, I no longer see the burst. As I'm having some trouble logging into the switches via console, I'm not able to check on the configurations of the switches.

My question is, could the burst be due to my initial connection? Did connecting Sw1 and Sw2 to 2 switches somehow cause the burst?

Rayne
  • 201
  • 2
  • 13
  • 3
    The way the switches are connected would definitely create multiple switch loops if Spanning Tree Protocol isn't enabled on the switches, which is the first thing I'd be looking at. – joeqwerty Oct 27 '18 at 04:38
  • 1
    Switches don't generally originate DHCP, DNS, or ARP traffic. I have no idea what FIP traffic is. – joeqwerty Oct 27 '18 at 04:43
  • The DHCP, DNS and ARP traffic are likely generated by the servers connected to Sw1 and Sw2. I usually see them being generated at a slow rate of maybe a few a second. But when there is a burst, there is more than 60K of these packets in an instant, and I'm wondering if the switch could have somehow blasted out these packets. – Rayne Oct 27 '18 at 05:54
  • Thanks for the suggestion on looking at STP on the switches. I'll do that once I can login to the switches. – Rayne Oct 27 '18 at 05:55

0 Answers0