All manufacturers switch's allow you to set broadcast limits on a per port basis. However I used to work for a large manufacturer of switch gear whose name rhymes with Disco and in my experience prevention in the way of good switch practice is far better than cure.

As such you could just place wireshark on any port in that vlan and filter on MAC ff:ff:ff:ff:ff:ff or IP broadcast 255.255.255.255. You need to be sniffing on the relevant VLAN. Finally, sort the list by bytes and attempt to find the culprit when stuff happens.īroadcast's and multicasts, which a switch not running IGMP snooping will treat as broadcasts, will appear on every port within the SAME vlan and that is important. Select 'Start' and then go into 'Statistics', 'Conversations' and select the 'IPv4' tab.ĥ. Select the 'Capture Filter' button and double click on the 'Broadcast and Multicast' filter.Ĥ. Select the 'Show the capture options' toolbar button.ģ.

Would this constitute a problem, or could that have been normal?Īdding onto the capabilities of Wireshark to find top broadcasters (or multicast packets which can also affect network activity) the following can be done:ġ. The machine was a timeclock machine that they would use for managing employee punches (it was a computer, whereas they also have 2-3 punch in terminals but no issues from those IP addresses). As an example, I think it was showing a total of 30,000 bytes compared to the next nearest machine which was under 9k (possibly a lot lower, I need to go look at my screenshot again). When I ran wireshark, I did notice that one particular computer had a lot higher bytes than the others. My question is, I'm not really sure what constitutes an abnormality. My question is, I tried following another spiceworks post on how to track it down (post in bold below).

I checked that first this time, and it was ok. Now, this may very well be something else, but in the past, we caught one of their switches with a loop which was causing a broadcast storm. Had a client today that was complaining of intermittent connection issues.

Filter ip wireshark