Reducing Switch Activity

I have a 3com Superstack II 1100 switch at my work, and for some reason, all the lights flicker together... Normally it isn't to bad, but sometimes all these activity lights start to flicker like some computer is sending enormous amount of data to the broadcast channel or something.... Can anybody tell me how I can solve this problem? The switch has a lot of capabilities like (FastIP, Broadcast Storm Controll????, Port Trunking, and so on.....)
I have just a fair understanding about broadcast data.... (something to do with the last ip of the subnet or something)....

Thanx already,
Jori Huisman

The network is talking all the time, even when you are sleeping.

Random bursts of activity would be different depending on what type of network you have. If you have a Novelle network, workstations are constantly talking. Routers send routing tables back and forth. Windows sends browser lists every 12-15 minutes.

If you are just getting random bursts, this may be normal activity.

There really isn't a "broadcast channel", per se. When a computer sends a broadcast it is just sending a message for all to see, such as an ARP. This is not going to any particular workstation. A broadcast address for the network 192.168.122.x would be 192.168.122.255 (the host id would be all bits on).

Get your laptop, plug it into your network and sniff. Filter out anything to or from the laptop (oviously) and your see exactly what it is and who is causing it.

As Tom said, the network is always doing something.. I remember when we converted to catalyst switches I was wondering why the lights were going crazy all the time..

All the lights go on at the same time usually when there's a broadcast.. i don't know your topology, but maybe you've got a broadcast storm going on there.. check the settings on the switch.. and make sure you haven't done something silly like setting up a bunch of switches in ring topology or something..

Ultimately don't worry about it unless the network is slow.. if you're experiencing good speed, dont bother about it.
Manips idea of sniffing the traffic is good as it might tell you what is being broadcast all the time.. keep in mind however that sniffing switched traffic is a little more complex.. you have to do one of three things :
put the machines to monitor on a hub with the sniffing computer,
span all the ports while sniffing (not a good idea)
use dsniff or similar software which can poison the arp cache and make the switch send you all data.

some switches specifically have a monitor port though.. which you can plug into and observe.

if you need to control broadcasts, you could consider using VLANs.. assuming your switch(es) support them.


Sahir.

When you refer to Windows sending browser lists. What exactly are you talking about?

Is it the list off all available computers logged on or are you talking about something different?

Essentially, yes.

What happens is some of the computers in a windows network, normally an NT server, will carry the list. When you log on, you announce yourself and are added to the list. Sometimes you will have multiple machines that carry the list. This list is broadcasted at various time intervals.