Re: Seeing hundreds of inbound broadcast

["Ross Cornett" <tech@...]

I found them just by looking at the interface on my router.  Since they
appear on the inbound side, I felt that this had to be coming from my
backbone provider.  These interfaces do not have any other connectivity on
the network other than the serial port.


----- Original Message -----
From: "Joe Pampel" <joe@...>
To: <isp-routing@isp-routing.com>
Sent: Thursday, May 30, 2002 3:29 PM
Subject: Re: Seeing hundreds of inbound broadcast


at the risk of asking a stupid question, how can you tell where they are
coming from? Do you
just make a temp logging ACL entry and slog though that or? I have been
trying to figure out how
to tell what is causing our traffic, where it's going to and from.. and
short of using TCPdump to
sniff everything all the time and then doing some kind of sort on it, how
can you really know? cflowd? netflow?
What's an affordable solution for a smaller shop?
Any pointers welcome!

>>> jmartin <jmartin@...> 05/30/02 02:06PM >>>
what networks/subnets are they coming from?  they should only be directed
broadcasts. its probably just some clowns trying to scan your network.


----- Original Message -----
From: "Ross Cornett" <tech@...>
To: <isp-routing@isp-routing.com>
Sent: Thursday, May 30, 2002 7:09 AM
Subject: Seeing hundreds of inbound broadcast


> Can anyone suggest to me why I would be seeing incoming broadcast on my t1
> connections from my backbone provider.  AT&T is my provider and they are
not
> seeing broadcasts leaving their network to bet to mine.  But every
interface
> I have from them is racking them up continually.
>
> Received 3179206 broadcasts
> Received 3213403 broadcasts
> Received 2154312 broadcasts
>
> These are all of my inbound interfaces and look at what I am
getting...Since
> my last counters reset.  Which was maybe a week ago.
>
> I guess my next question is am I losing bandwidth due to this.   Any help
> would be greatly appreciated.
>
> Thank you
>
> Ross C
>
>
>




>









**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been swept by
MIMEsweeper for the presence of computer viruses.

www.mimesweeper.com
**********************************************************************