# Network storm happened this morning



## seth_turner_04 (Sep 20, 2006)

Our network flaked out on us for a bit this morning until we restarted one of the servers and a couple switches. My boss got a wireshark capture of what was happening during this time. The network was being flooded by ZIP traffic with a source of 65280.3 and a destination of 0.255. I've never seen that traffic before on our network and all the printers have Appletalk disabled.

Any ideas on what happened? If I need to post my wireshark log somehow, let me know and I'll try to do that.


----------



## grue155 (May 29, 2008)

I've never worked with an Appletalk network, but from the TCP/IP universe what you've described sounds like a broadcast storm, likely caused by a hardware failure. 

If you are running on top of an Ethernet/IP network, then the MAC address of the packets in the Wireshark capture are the clue to what hardware is most suspect. That it was necessary to power down a couple of switches also kind of complicates the hardware search, as the switch could get stuck in a packet replication (kind of like a photocopy machine, with the copy button stuck ON)

If it was me, I'd be budgeting for a new network card, and at least one swtich (just in case).


----------



## seth_turner_04 (Sep 20, 2006)

We have an extra 3Com 2226 switch on hand and a couple of NIC's. The wireshark capture said the source was from an NEC nic card. I've got it wrote down and have been searching through our workstations for that MAC, but haven't found it.

We've had this happen a time or two before also. It always seems to happen around the time a storm comes so I'm pretty sure it's a piece of hardware, just not sure if it's a switch or a NIC card on a workstation.


----------



## johnwill (Sep 26, 2002)

You need to start isolating parts of the network until you find the failing component.


----------



## john_1 (Jul 6, 2008)

i dont know if your switch support this in managment but what you can do is search for the the port in the switch by login to the managment of the switch and look in the mac-table of the switch and try to identify the port . some switches like 3com 2200,3300 provide search functionality ..... means you enter the mac you get the port. 

if you can't do that i agree with john 
get dirty and start to disconnect your network segment by segment till u find it.


----------



## seth_turner_04 (Sep 20, 2006)

There's a lot I need to go through and dissect in our network because it's a mess! It was put in place about 7 years before I came here and there's a lot of wiring that seems to go off into no mans land. I managed to trace all the uplink cables from the switches to a central location last year and I just have to find the time to dig deeper and start labeling everything.

Thanks for the advice.


----------



## johnwill (Sep 26, 2002)

Don't know of an easier way, especially with an undocumented network. :smile:


----------

