Troubleshooting Switched Ethernet Networks
Troubleshooting Ethernet broadcast traffic

Where excessive broadcasts are observed, it is important to identify the source of the broadcasts so that appropriate steps can be taken. When analyzing traffic, keep in mind that switches are responding to broadcast frames, while traffic analyzers are usually more concerned about the Layer 3 packets. Generally this is not a problem as a broadcast packet is carried by broadcast frame but different tools will report broadcasts differently depending on whether they have a Layer 2 or Layer 3 focus.

Generally, excessive broadcasts result from one of the following situations:

  • Poorly programmed or configured applications.
  • Large Layer 2 broadcast domains.
  • Underlying network problems such as STP loops or route flapping.

Using a protocol analyzer, the source of the problem can be readily ascertained. Each of the above situations dictates a different solution.

Some applications such as Symantec’s Ghost server and streaming video servers use broadcast and multicast traffic. This is an attempt to reduce the number of streams of traffic sent, thereby minimizing bandwidth usage and to improving performance. If the network requires applications that are heavy producers of broadcast and multicast traffic, consider the following techniques to reduce the impact on other devices in the network:

  • Create a separate VLAN for devices and hosts that are broadcast intensive.
  • Configure switches to be multicast aware.
  • Consider using scheduling for distribution services such as Ghost, so that broadcast traffic can be limited to off peak times.

Large Layer 2 broadcast domains can sometimes occur where the hosts themselves do not generate much traffic and their perceived network needs are not great. It is tempting in these situations to avoid the expense of a Layer 3 hierarchy and simply adopt a flat, switched, structure. Unfortunately, modern operating systems use broadcasts extensively to discover network services and other hosts. Large, lightly loaded, Layer 2 networks will quickly find that the majority of their traffic is made up of broadcasts.