Frame Relay: Broadcast Storm?

Discussion in 'Cisco' started by Robert B. Phillips II, Oct 28, 2004.

  1. Group,
    I am a relative newbie to Frame Relay WANs so you will have to be
    patient with me. Is is possible for a router to create a broadcast
    storm on a Frame Relay PVC without the hardware being faulty? Second,
    if it is possible is it possible the broadcast storm spread to other
    PVCs configured on the router? It was my understanding that even if
    one PVC/subinterface goes down or is brought down due to a broadcast
    storm, the other PVCs are unaffected unless it is a circuit issue? We
    have a situation where the telco is telling us a supposed "broadcast
    storm" on one PVC caused a subsequent broadcast storm on another PVC
    until all 4 our PVCs were engulfed in the broadcast storm and the site
    (and others like it) lost all connectivity on all 4 PVCs. Mysteriously
    the storm stopped and all returned to normal. The telco is telling us
    we caused the storm and will not look into the issues further, they
    pinpointed a specific router and the specific PVC that caused the
    issue but offered no further assistance. I checked the config on the
    router and nothing had changed that might have caused any issues.

    Any thoughts, ideas, or information that might help me better
    understand this scenario. I am interested minimizing or alleviated
    such problems in the future if possible by shoring up my end of the
    deal. Telcos are tough :)

    -Robert
    Robert B. Phillips II, Oct 28, 2004
    #1
    1. Advertising

  2. Robert B. Phillips II

    PES Guest

    "Robert B. Phillips II" <> wrote in message
    news:...
    > Group,
    > I am a relative newbie to Frame Relay WANs so you will have to be
    > patient with me. Is is possible for a router to create a broadcast
    > storm on a Frame Relay PVC without the hardware being faulty? Second,
    > if it is possible is it possible the broadcast storm spread to other
    > PVCs configured on the router? It was my understanding that even if
    > one PVC/subinterface goes down or is brought down due to a broadcast
    > storm, the other PVCs are unaffected unless it is a circuit issue? We
    > have a situation where the telco is telling us a supposed "broadcast
    > storm" on one PVC caused a subsequent broadcast storm on another PVC
    > until all 4 our PVCs were engulfed in the broadcast storm and the site
    > (and others like it) lost all connectivity on all 4 PVCs. Mysteriously
    > the storm stopped and all returned to normal. The telco is telling us
    > we caused the storm and will not look into the issues further, they
    > pinpointed a specific router and the specific PVC that caused the
    > issue but offered no further assistance. I checked the config on the
    > router and nothing had changed that might have caused any issues.
    >
    > Any thoughts, ideas, or information that might help me better
    > understand this scenario. I am interested minimizing or alleviated
    > such problems in the future if possible by shoring up my end of the
    > deal. Telcos are tough :)
    >
    > -Robert


    If the pvc could fill the port speed, a single pc could bring down others
    aggregated on the same port. However, I think broadcast needs to be
    defined. Routers don't forward broadcasts at all without being told to do
    so. Additionally, to broadcast even a rip packet on a pvc, there can be
    special configuration requirements. I also figure that it is unlikely that
    you are bridged to a pvc. My guess is that the telco saw a large amount of
    traffic on the circuit and said broadcast. For him to actually see that it
    is broadcast would require that he decode the traffic to lawer 3 which is
    unlikely that he would do. You may want to look into some free monitoring
    like mrtg or buy something cheap or trial like wan spy. I would prefer
    mrtg. This will give you the ability to point the finger back at them if
    you experience this in the future.
    PES, Oct 29, 2004
    #2
    1. Advertising

  3. > If the pvc could fill the port speed, a single pc could bring down others
    > aggregated on the same port. However, I think broadcast needs to be
    > defined. Routers don't forward broadcasts at all without being told to do
    > so. Additionally, to broadcast even a rip packet on a pvc, there can be
    > special configuration requirements. I also figure that it is unlikely that
    > you are bridged to a pvc. My guess is that the telco saw a large amount of
    > traffic on the circuit and said broadcast. For him to actually see that it
    > is broadcast would require that he decode the traffic to lawer 3 which is
    > unlikely that he would do. You may want to look into some free monitoring
    > like mrtg or buy something cheap or trial like wan spy. I would prefer
    > mrtg. This will give you the ability to point the finger back at them if
    > you experience this in the future.


    So you are saying if the one PVC took all of the serial interfaces
    bandwidth than it could have brought down the other PVCs? That seems
    logical, never thought of things that way, I am not sure what we are
    doing to rate-limit per PVC if anything.

    We run EIGRP on the WAN side for routing and they alluded to the fact
    that they thought maybe EIGRP was to blame. But it is my understanding
    that EIGRP is all multicast and unicast for updates and hellos
    respectively, so I am not sure that is the case. The PVCs are not
    bridged, and we are not redistributing any other routing protocols
    into EIGRP for there to be issues.

    Thanks for your input, we are currently under support of a third-party
    NOC, they don't offer any monitoring like MRTG or Wan Spy. We are
    already somewhat unhappy with their support, so maybe this incident is
    a good way to leverage some additional services or a new NOC.
    Robert B. Phillips II, Oct 29, 2004
    #3
  4. My initial thought is that the carrier is using the term 'broadcast
    stom' incorrectly, since Frame Relay is a non-broadcast medium. When
    the carrier referenced 'broadcast storm' he was probably seeing a
    large amount of traffic on each PVC being generated from your
    location. A lot depends on your configuration, but massive file
    downloading, worms, failing hardware, etc. could cause a similar
    issue.

    You may want to consider enabling NetFlow on your device and
    purchasing/downloading a trial NetFlow collector to see the type /
    source / destination / amount of your traffic. Crannog has a great
    program that is simple and quick to install. This should be a fairly
    safe and easy operation, but you still may want to enable NetFlow on
    the router during a low traffic period.


    > Group,
    > I am a relative newbie to Frame Relay WANs so you will have to be
    > patient with me. Is is possible for a router to create a broadcast
    > storm on a Frame Relay PVC without the hardware being faulty? Second,
    > if it is possible is it possible the broadcast storm spread to other
    > PVCs configured on the router? It was my understanding that even if
    > one PVC/subinterface goes down or is brought down due to a broadcast
    > storm, the other PVCs are unaffected unless it is a circuit issue? We
    > have a situation where the telco is telling us a supposed "broadcast
    > storm" on one PVC caused a subsequent broadcast storm on another PVC
    > until all 4 our PVCs were engulfed in the broadcast storm and the site
    > (and others like it) lost all connectivity on all 4 PVCs. Mysteriously
    > the storm stopped and all returned to normal. The telco is telling us
    > we caused the storm and will not look into the issues further, they
    > pinpointed a specific router and the specific PVC that caused the
    > issue but offered no further assistance. I checked the config on the
    > router and nothing had changed that might have caused any issues.
    >
    > Any thoughts, ideas, or information that might help me better
    > understand this scenario. I am interested minimizing or alleviated
    > such problems in the future if possible by shoring up my end of the
    > deal. Telcos are tough :)
    >
    David Wolfenbarger, Oct 29, 2004
    #4
  5. My initial thought is that the carrier is using the term 'broadcast
    stom' incorrectly, since Frame Relay is a non-broadcast medium. When
    the carrier referenced 'broadcast storm' he was probably seeing a
    large amount of traffic on each PVC being generated from your
    location. A lot depends on your configuration, but massive file
    downloading, worms, failing hardware, etc. could cause a similar
    issue.

    You may want to consider enabling NetFlow on your device and
    purchasing/downloading a trial NetFlow collector to see the type /
    source / destination / amount of your traffic. Crannog has a great
    program that is simple and quick to install. This should be a fairly
    safe and easy operation, but you still may want to enable NetFlow on
    the router during a low traffic period.


    > Group,
    > I am a relative newbie to Frame Relay WANs so you will have to be
    > patient with me. Is is possible for a router to create a broadcast
    > storm on a Frame Relay PVC without the hardware being faulty? Second,
    > if it is possible is it possible the broadcast storm spread to other
    > PVCs configured on the router? It was my understanding that even if
    > one PVC/subinterface goes down or is brought down due to a broadcast
    > storm, the other PVCs are unaffected unless it is a circuit issue? We
    > have a situation where the telco is telling us a supposed "broadcast
    > storm" on one PVC caused a subsequent broadcast storm on another PVC
    > until all 4 our PVCs were engulfed in the broadcast storm and the site
    > (and others like it) lost all connectivity on all 4 PVCs. Mysteriously
    > the storm stopped and all returned to normal. The telco is telling us
    > we caused the storm and will not look into the issues further, they
    > pinpointed a specific router and the specific PVC that caused the
    > issue but offered no further assistance. I checked the config on the
    > router and nothing had changed that might have caused any issues.
    >
    > Any thoughts, ideas, or information that might help me better
    > understand this scenario. I am interested minimizing or alleviated
    > such problems in the future if possible by shoring up my end of the
    > deal. Telcos are tough :)
    >
    David Wolfenbarger, Oct 29, 2004
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Jose E. Calderon
    Replies:
    0
    Views:
    644
    Jose E. Calderon
    Oct 23, 2003
  2. wr
    Replies:
    0
    Views:
    605
  3. Vimokh
    Replies:
    3
    Views:
    5,658
    Vimokh
    Sep 6, 2006
  4. Replies:
    2
    Views:
    685
  5. sunrock122000

    broadcast storm problem

    sunrock122000, Feb 23, 2008, in forum: Cisco
    Replies:
    0
    Views:
    3,012
    sunrock122000
    Feb 23, 2008
Loading...

Share This Page