[c-nsp] Broadcast storm on Cat6500

[Tolstykh, Andrew]

Do you have NIC teaming activated on the server?

"show mac-address-table address HH.HH.HH"

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of David Coulson
Sent: Thursday, June 26, 2008 9:13 PM
To: Cisco
Subject: [c-nsp] Broadcast storm on Cat6500

We experienced a weird issue today on a Catalyst 6500 (Sup720, 12.2SXF).

The switch has a variety of cef256 and cef720 cards, but there are no 
DFCs involved.

Two devices within the same VLAN were talking to each other via TCP - 
nothing exciting. Devices are on two different cards within the chassis.

We began to see all traffic going in one direction being broadcast out 
all ports on that VLAN. The rate of broadcast was higher than the 
traffic flow. It goes without saying that this was bad.

CAM table looked right (3500 entries of 65k), no STP involved, so we're 
pretty confused. Unless I am missing something, if the switch has a CAM 
entry for the MAC and the packet is a simple Unicast TCP packet, there 
is no reason why it should be broadcast to any other ports.

Any ideas how to even start troubleshooting this? I was hoping I might 
find a port which was looping the traffic back, but so far we're not 
finding anything particularly exciting. As soon as we killed the TCP 
session, the storming stopped and there has not been a repeat.

David
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 
The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited.  If you received this in error, please contact the sender and delete the material from any computer.