• Like
OSTU: How to Start a Broadcast Analysis - Part One (Tony Fortunato)
Upcoming SlideShare
Loading in...5

Thanks for flagging this SlideShare!

Oops! An error has occurred.

OSTU: How to Start a Broadcast Analysis - Part One (Tony Fortunato)


Tony Fortunato is a Senior Network Specialist with experience in design, implementation, and troubleshooting of LAN/WAN/Wireless networks, desktops and servers since 1989. His background in financial …

Tony Fortunato is a Senior Network Specialist with experience in design, implementation, and troubleshooting of LAN/WAN/Wireless networks, desktops and servers since 1989. His background in financial networks includes design and implementation of trading floor networks. Tony has taught at local high schools, Colleges/Universities, Networld/Interop and many onsite private classroom settings to thousands of analysts.

Published in Technology
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
    Be the first to like this
No Downloads


Total Views
On SlideShare
From Embeds
Number of Embeds



Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

    No notes for slide
  • Hello, It’s Tony Fortunato from the Technology Firm In this session I am going to share some broadcast analysis tips and tricks Enjoy
  • Customers typically challenge me that there will always be broadcasts, they are so small and so few, so why bother? When I explain the symptoms I have found surrounding broadcast storms, I get their interest. When I go further to describe a lab I did for a customer where a 10% locked up their Winterms, they get really interested Finally I tell them to remember that a broadcast or multicast packet will cause an interrupt, they start to connect the dots
  • In many cases, my customers may not understand how a 10% storm was more damaging than the 90% After showing them some simple math, it becomes apparent that the bandwidth isn’t as important as packet rate and packet size I also explain that I always use the small packet numbers in my charts since most broadcasts are on the small side So we should reduce them, since we can not entirely eliminate them
  • Sometimes when I work on some networks with broadcast storms, I wonder why the client ‘piled’ everything into one VLAN? In some cases the customer told me that the vendor ‘baselined’ the network and it was fine Broadcasts will affect different hosts at different rates. I have seen a 2% broadcast storm on the 100Mbps LAN lock up a wireless camera I guess this is where VLANS come in.
  • The key with this slide is to understand that anything can send out broadcasts, but you should know what protocols should be out there I will take one of these topics for this presentation. In the future I will cover different protocols
  • I’m not a big fan of setting up a discovery PC that send out more of these unwanted protocols. A simple protocol Analyzer will do just fine. I will use Wireshark for my example The process is pretty straight forward; Connect pc to a VLAN and setup a stop capture setting for 8 MB It start and go do something else. No peeking.
  • I have witnessed the colorful language when people see 40 or 50 thousand packets and don’t know where to start With Wireshark, I take it a protocol at a time. This way if I find a pattern, like printers that need cleaning up, I can send off an email to the PC department or help desk to clean them up and move on to something else
  • In this example, I know this customer is a pure Microsoft shop, so IPX is a bit odd I simply right click on IPX and Apply a filter
  • As a bit of background, I have been here before and the first time we did there there were dozens of entries and now my customer is not expecting any IPX. To his surprise there is one printer they missed. He was disappointed there was one, but I told him not to take it that way. The way I see it they got rid of all their IPX and this one is left. My client asked if we can figure out the IP address To do this we filtered on the lexmark mac address
  • In this case we see 2 ip addresses, one is the broadcast, and the other is the printer ip address If you find a lot of IP’s you may want to change your mac filter to a unidirectional filter
  • Hope this helps you out and I will keep adding to this with various other protocols Enjoy and Good day


  • 1. Examining How to start a Broadcast Analysis Part 1 Tony Fortunato, Sr Network Specialist The Technology Firm
  • 2. Why Bother
    • Broadcasts can cause;
    • Network slowdowns
    • Rebooting or Frozen PC’s
    • Unreliable WIFI
    • Unpredictable application or window client performance
    • Extra ‘space junk’ that you need to sift through when troubleshooting
    • I have seen10% broadcast storm ‘lock up’ WInterms, while a 90% broadcast storm did nothing
    • In most cases, a broadcast or multicast packet will result in an interrupt on your PC
  • 3. How
    • People always ask me how could 10% packet rate cause an issue.
    • Then I explain that we generated 2 loads with a traffic generator;
      • 90 % broadcast rate
        • No noticeable issue
      • 10 % broadcast rate
        • PC’s locked up or hung
    • Here are the number of theoretical number of packets you can generate, depending on packet size and media speed
      • 90%, 1518 Byte packets on 100 MB link = 7,411 packets/second
      • 10%, 64 Byte packets on 100 MB link = 19,531 packets/second
    • In many cases you can REDUCE broadcasts, not eliminate them
  • 4. Common Networks and Related Issues
    • In some cases the math may reveal or explain some of your current issues
    • I still see many flat networks, everything on the same VLAN
    • There should be separate VLANS for minimally each technology
  • 5. Sources of Broadcasters
    • Anything default protocol settings will send out extra broadcast or multicast packets
    • Printers
    • PC’s
    • Routing Protocols
    • Mis-configured standard PC builds
    • Example of excessive protocols
    • IPX
    • LLC or NetBEUI
    • IPV6, if you are a V4 shop and vice versa
    • STP, if you are not using spanning tree
    • Teaming or load balancing protocols
    • UPNP
    • RIP
    • New Microsoft Peer to Peer protocols
  • 6. Now what?
    • How can I find out if I have this problem, or clean it up?
      • Protocol Analyzer is the easiest tool to use.
    • Start a capture from an idle PC and set a Stop Capture Trigger at 8 MB
      • Leave the PC alone – Go for lunch you deserve it ;b
    • Come back, and lets review the trace file
  • 7. Step 1 – What’s out there?
    • For most people, step 1 involves looking at the screen and yelling, “HOLY @#$$@%$”
    • We’ll try another approach;
      • Go to Statistics -> Protocol Hierarchy
    • The hard part of this exercise is to have an idea or guess-timate of what protocols you think should be on the network
    • It s discouraging when I hear the analyst grumble, ‘I don’t know what that is, but there are only a few of those packets, so lets skip them’
    • I would hope now that you have the trace file, you can pick away at it whenever you have a moment
  • 8. Step 2 – Pick a Protocol, Any Protocol
    • this customer does not use IPX for anything, so this would be a good start.
    • In this case I know this customer does not use IPX for anything, so this would be a good start.
  • 9. Step 3; Pick An Address, Any Address
    • This is pretty easy now, the Fluke address is their Fluke Optiview , which leaves the Lexmark mac address.
    • Obviously this is a printer, but what is the IP address, so I can remotely fix it?
    • Simply filter on the Lexmark mac address, and click on the IPV4 tab.
  • 10. Step 4; FIX IT!!!
    • Make sure your “ limit to display filter” is checked off
    • The .255 ip address is just a broadcast address
    • Simply telnet or use a web browser to connect to the printer and clean it up
    • In some cases, you can forward the IP’s to another department, who can do this
  • 11. Examining How to start a Broadcast Analysis Part 1 Thank You Tony Fortunato, Sr Network Specialist The Technology Firm
  • 12.
    • For additional educational videos on Open Source Network Tools, please click on the following …
    • http://www.lovemytool.com/blog/ostu.html
    LoveMyTool.com – Community for Network Tools