Wired

Hello All,

a network with 2920 and 5406 and intermittently uplink ports send the warning "excessive broadcast  ". What I can not understand is why this alerts which leads to packet drop and and blank during voip calls while the ports never surpass 23 % of their utilization.
P.s wireshark says it is a flood of arp request.

Your help is appreciated.

Utilization typically is measured over longer times. You may have a network loop, or misbehaving devices. Where do those arp requests come from?
What ports do you see packet drop on? With the command 'show interfaces' you can see which ports have errors/drops; with 'show interface 3' you can see more details for port 3.

If you see the same arp request multiple times (like 100+ per second), it's probably a loop. If it is different arp request, it probably is a misbehaving client.

It may be that not the warning leads to the packet drops, but the excessive broadcasts lead to that your interface is overloaded (and the switch sees excessive broadcast).

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

Original Message:
Sent: Sep 06, 2022 02:24 PM
From: otman ibrak
Subject: port utilization

Hello All,

a network with 2920 and 5406 and intermittently uplink ports send the warning "excessive broadcast  ". What I can not understand is why this alerts which leads to packet drop and and blank during voip calls while the ports never surpass 23 % of their utilization.
P.s wireshark says it is a flood of arp request.

Your help is appreciated.

Hello Herman,

Thanks for your response.

take the core switch of our network, which is 2 X 2920 and 2X 5406zl, all its uplinks ports send this warning and show interfaces says all the 3 ports are dropping packets + the port used for the pbx and two other voip gateways.
I have checked again and found that the same arp request is forwarded by the core switch more than 844 in less than a seconde. On the other hand, I checked the whole network and I could not find any redundant connection that may lead to a loop. But I noticed that the people who implemented it made in daisy chain way, 1920 connected via their uplink ports and one of them is connected to the aggregator switch 5406.
please, be informed that the warning is received on all switches every 2 or 3 and sometimes more than 5 minutes. If it was a loop, I think the request will continue endlessly and bring the network down.
Original Message:
Sent: Sep 07, 2022 09:47 AM
From: Herman Robers
Subject: port utilization

Utilization typically is measured over longer times. You may have a network loop, or misbehaving devices. Where do those arp requests come from?
What ports do you see packet drop on? With the command 'show interfaces' you can see which ports have errors/drops; with 'show interface 3' you can see more details for port 3.

If you see the same arp request multiple times (like 100+ per second), it's probably a loop. If it is different arp request, it probably is a misbehaving client.

It may be that not the warning leads to the packet drops, but the excessive broadcasts lead to that your interface is overloaded (and the switch sees excessive broadcast).

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Sep 06, 2022 02:24 PM
From: otman ibrak
Subject: port utilization

Hello All,

a network with 2920 and 5406 and intermittently uplink ports send the warning "excessive broadcast  ". What I can not understand is why this alerts which leads to packet drop and and blank during voip calls while the ports never surpass 23 % of their utilization.
P.s wireshark says it is a flood of arp request.

Your help is appreciated.

Moreover, when I try to ping IP addresses involved in the repetitive arp request, they are unreachable.
Original Message:
Sent: Sep 07, 2022 09:47 AM
From: Herman Robers
Subject: port utilization

Utilization typically is measured over longer times. You may have a network loop, or misbehaving devices. Where do those arp requests come from?
What ports do you see packet drop on? With the command 'show interfaces' you can see which ports have errors/drops; with 'show interface 3' you can see more details for port 3.

If you see the same arp request multiple times (like 100+ per second), it's probably a loop. If it is different arp request, it probably is a misbehaving client.

It may be that not the warning leads to the packet drops, but the excessive broadcasts lead to that your interface is overloaded (and the switch sees excessive broadcast).

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Sep 06, 2022 02:24 PM
From: otman ibrak
Subject: port utilization

Hello All,

a network with 2920 and 5406 and intermittently uplink ports send the warning "excessive broadcast  ". What I can not understand is why this alerts which leads to packet drop and and blank during voip calls while the ports never surpass 23 % of their utilization.
P.s wireshark says it is a flood of arp request.

Your help is appreciated.

Hello,

Reviewing the network cabling, I found two loops. 

The issue is fixed. Thanks
Original Message:
Sent: Sep 07, 2022 09:47 AM
From: Herman Robers
Subject: port utilization

Utilization typically is measured over longer times. You may have a network loop, or misbehaving devices. Where do those arp requests come from?
What ports do you see packet drop on? With the command 'show interfaces' you can see which ports have errors/drops; with 'show interface 3' you can see more details for port 3.

If you see the same arp request multiple times (like 100+ per second), it's probably a loop. If it is different arp request, it probably is a misbehaving client.

It may be that not the warning leads to the packet drops, but the excessive broadcasts lead to that your interface is overloaded (and the switch sees excessive broadcast).

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Sep 06, 2022 02:24 PM
From: otman ibrak
Subject: port utilization

Hello All,

a network with 2920 and 5406 and intermittently uplink ports send the warning "excessive broadcast  ". What I can not understand is why this alerts which leads to packet drop and and blank during voip calls while the ports never surpass 23 % of their utilization.
P.s wireshark says it is a flood of arp request.

Your help is appreciated.