detecting flooded packets on a router

From: Geert Nijs (geert.nijs@simac.be)
Date: Thu Nov 10 2005 - 13:24:41 GMT-3


Hi group,

If a switch is flooding packets to its ports (because the destination
mac is not known), is there any way to detect this on a connected router
??
(i have access to the router , but not to the switch).

show interface or show controllers ??
I dont think the "ignored" number of show interface makes sense (these
are packets picked up by the router, but dropped because the CPU/queue
was to busy).
It really goes down to hardware level: i want to see packets that the
router didnt pick up, because it was not addressed to its mac address or
not a broadcast.
So show controller makes more sense to me, but i havent had any look
here also...........
rx_discard ? maybe ?

regards,
Geert

FastEthernet0/0 is up, line protocol is up
  Hardware is AmdFE, address is 0012.7f2d.4ce0 (bia 0012.7f2d.4ce0)
  Internet address is 10.132.16.2/23
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 100Mb/s, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters 1w2d
  Input queue: 0/75/2864/0 (size/max/drops/flushes); Total output drops:
0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 216000 bits/sec, 42 packets/sec
  5 minute output rate 165000 bits/sec, 37 packets/sec
     18630866 packets input, 1313167557 bytes
     Received 1359599 broadcasts, 0 runts, 0 giants, 0 throttles
     1 input errors, 0 CRC, 0 frame, 0 overrun, 1 ignored
     0 watchdog
     0 input packets with dribble condition detected
     20039228 packets output, 266116783 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out

Interface FastEthernet0/0
Hardware is AMD Am79c977
ADDR: 81F58DC4, FASTSEND: 8002E8B0, MCI_INDEX: 0
DIST ROUTE ENABLED: 0
Route Cache Flag: 19
 LADRF=0x0000 0x0100 0x0009 0x0000
 CSR0 =0x00000042, CSR3 =0x00000004, CSR4 =0x0000080C, CSR15
=0x00008000
 CSR80 =0x00001800, CSR114=0x00000000, CRDA =0x00000000, CXDA
=0x00000000
 BCR9 =0x00000001 (full-duplex)
 CSR5 =0x00000001, CSR7 =0x00000008, CSR100=0x00000000,
CSR125=0x00005C3C
 BCR2 =0x00001000, BCR9 =0x00000001, BCR18 =0x00001880, BCR22
=0x00001818
 BCR25 =0x00000200, BCR26 =0x00000100, BCR27 =0x00000000, BCR32
=0x00004D80
 HW filtering information:
  Promiscuous Mode Enabled, PHY Addr Enabled, Broadcast Addr Enabled
  PHY Addr=0012.7F2D.4CE0, Multicast Filter=0x0000 0x0100 0x0009 0x0000
 amdp2_instance=0x81F46A24, registers=0x40000000, ib=0x7C17720
 rx ring entries=64, tx ring entries=128
 rxring=0x7C17780, rxr shadow=0x81F5AACC, rx_head=46, rx_tail=0
 txring=0x7C17BC0, txr shadow=0x81F5ABF8, tx_head=112, tx_tail=112,
tx_count=0
 Software MAC address filter(hash:length/addr/mask/hits):
  0x00: 0 ffff.ffff.ffff 0000.0000.0000 1831412
  0x0D: 0 0000.0c07.ac01 0000.0000.0000 35385245
  0x54: 0 0100.5e00.000a 0000.0000.0000 467213
  0x5C: 0 0100.5e00.0002 0000.0000.0000 744691
  0x9F: 0 0012.7f2d.4ce0 0000.0000.0000 3271242
  0xC0: 0 0100.0ccc.cccc 0000.0000.0000 99082
 spurious_idon=0, throttled=0, enabled=0, disabled=0
 rx_framing_err=0, rx_overflow_err=0, rx_buffer_err=0
 rx_bpe_err=0, rx_soft_overflow_err=0, rx_no_enp=0, rx_discard=0
 tx_one_col_err=0, tx_more_col_err=0, tx_no_enp=0, tx_deferred_err=0
 tx_underrun_err=0, tx_late_collision_err=0, tx_loss_carrier_err=401
 tx_exc_collision_err=0, tx_buff_err=0, fatal_tx_err=0
 hsrp_conf=1, need_af_check=1
 tx_limited=0(64)
 PHY registers:
  Register 0x00: 2100 780D 0013 78E2 0101 0000 0004 2001
  Register 0x08: 0000 FFFF FFFF FFFF FFFF FFFF FFFF FFFF
  Register 0x10: 0104 4600 0000 0000 0000 0000 0000
  Register 0x18: 0000 0000 01C8 0000 FFFF

#############################################################################
########
Simac N.V. trades under the commercial name Simac ICT Belgium.
This e-mail and any attached files are confidential and may be legally
privileged.
If you are not the addressee, any disclosure, reproduction, copying,
distribution,
or other dissemination or use of this communication is strictly prohibited.
If you have received this transmission in error please notify Simac
immediately
and then delete this e-mail.

Simac has taken all reasonable precautions to avoid virusses in this email.
Simac does not accept liability for damage by virusses, for the correct and
complete
transmission of the information, nor for any delay or interruption of the
transmission,
nor for damages arising from the use of or reliance on the information.

All e-mail messages addressed to, received or sent by Simac or Simac employees
are deemed to be professional in nature. Accordingly, the sender or recipient
of
these messages agrees that they may be read by other Simac employees than the
official
recipient or sender in order to ensure the continuity of work-related
activities
and allow supervision thereof.
#############################################################################
########



This archive was generated by hypermail 2.1.4 : Thu Dec 01 2005 - 09:12:06 GMT-3