[NTLUG:Discuss] Broadcast Storms

[Stephen Klein]

I doubt it's a forwarding problem, take that with a grain of salt, I
don't know the whole story of how things are set up on your systems.

Broadcast packets are typically not forwarded across routers, unless the
router is intentionally configured to do so.  I'm not sure about the
broadcast storm problem, I suspect it is due to all interfaces
responding to broadcasts of some sort, then all sending their own
broadcast, and finally whatever sent the original broadcast request
responds back.  Since it's all on the same wire, things get flooded.

The term BROADCAST in ifconfig is the type of medium that ethernet is,
everything sent out by one NIC is received by every other NIC on the
segment.

  Usually, a packet is only addressed to a single NIC, and the NIC sorts
these out and passes them to the host.  All broadcast packets have to be
handed up to the host for inspection by higher level protocols to
determine if each packet is intended for that host.

Someone else would probably be of more help here.  But I would
recommend, if you are not already doing so, using a packet sniffer to
determine exactly what service these broadcast packets are for.  Once
you know that, you might be able to determine a solution.

Hope I helped at least a little,
Stephen


> "Gregory L. Camp" wrote:
> 
> We have a RedHat 6.0 box that has multiple interfaces defined on
> eth0.  We are using it to route packets between various subnets.  That
> part is working well.
> 
> It also appears that each interface is configured with BROADCAST on.
> And we seem to be receiving broadcast storms at various times during
> the day that are affecting operations.
> 
> Here's my questions:
> When BROADCAST is on for an interface, does that mean it will forward
> all broadcast packets to each of the subnets?
>     If so, does anyone know how to disable that?
>     Could you use ipchains to stop the forwarding if you cannot
> disable that functionality?
> 
> If BROADCAST does *not* mean it will forward bcast packets, does
> anyone have any other ideas of how to track down what might be causing
> this?
> 
> (Two comments:  This started shortly after adding the multiple
> interfaces on this machine, so we believe it is the cause.  And
> secondly, I have tried ifconfig with a -broadcast parameter with no
> effect.  The BROADCAST flag still shows up when you look at ifconfig.)
> 
> Gregory L. Camp
> Gregory.Camp at osc.com
> 
> --
> OSC, a subsidiary of Billing Concepts Corp., a NASDAQ listed Company,
> Symbol: "BILL"


if hours_without_sleep > 20 then       {too many hours awake?}
  send_message := false                {true: don't make fool of self}
else
  send_message := true;                {false: sufficient mental}
                                       {awareness, unit caffine.pas}
read_incomming_messages(send_message); {will add extra functionality}
-S.K. e-mail etiquette training program.