Start a Conversation
UNSOLVED

kyiyer

updated

21 years ago

K

kyiyer

5 Posts

0

9625

November 2nd, 2005 09:00

Packet storm - 3348

Hi

We have recently installed a bunch of PowerConnect 3348 switches

For the second time this year, we have had a faulty cable/fault bring the whole network down.

We have three VLANs - configured and connected on a Cisco 3550 switch. This switch is used by the three VLANs to communicate with each other.

One of the subnets which houses the end-user computers has about 400 systems (desktops and servers) in it.

What kind of packets does a faulty cable/NIC generate? Sniffer output makes no sense at all - we had a virus attack and we managed to isolate the offending computer in quick time. But with a faulty cable, all we managed to do was to start isolating every part of the network by bringing one switch down at a time and looking for the problem computer - takes ages and is really painful - specially when you have 400 users calling you to abuse you ;-)

Can some kind of rules be put into the 3348s to ensure that such traffic remains isolated and does not bring the whole network down?

I understand that I can add ACLs into the switches and open just the ports required for the applications that the users run. Or I can create VLANs for each area/department/floor of the organisation.

Which is the better way?

Thanks very much

Best wishes

Yeggi
  • DC

    DELL-Cuong N.

    1017 Posts

    344

    0

    Posted November 3rd, 2005 13:00

    I consulted with a few of my colleagues to see if there is anyway a faulty cable could result in the problem you described and we don't believe it can.  A faulty cable would result in mal-formed packets which would not be able to pass initial check by the switch so would be dropped and not forwarded anywhere.  If you check the switch RMON counters on the port where you believe you have a faulty cable you should be able to see error packet counts going up and verify that it is really a faulty cable.  These packets would be dropped at the incoming port however and should not enter your network.
     
    We think that perhaps it is more likely that you have either a virus attacking your network or a bad application that is sending legitimate looking packets but maybe just alot of these packets to cause the flood.
     
    If it is a virus or bad app then setting up VLAN could help you isolate the area of affect to just a single network and locallize the problem but would not eliminate it.  ACL would not really help if it is a virus since the virus would likely looks like normal traffic that you already allowed into the network.  You could setup ACL to block particular port known to be vulnerable (or as you suggested only allow certain valid ports through) but virus are pretty smart now and could disguise as legitimate network traffic.
     
    Perhaps isolating using VLAN to limit the network as much as possible could reduce your exposure during a virus attack.  However it is perhaps better to invest in a good firewall that is able to detect active attacks and shut down the source port generating the traffic.  A good firewall could help you block attacks from the outside and could monitor your internal network to prevent the attacks internally too.
     
    Cuong.
  • K

    kyiyer

    5 Posts

    344

    0

    Posted November 3rd, 2005 16:00

    Hi

    Thanks a million for your response.

    Unfortunately I am quite sure that a faulty cable has caused the whole network to choke - we isolated one switch about three months back - and then isolated the exact cable and found that a carpenter had been at work on that table and cut through the cable insulation and all cables were intertwined.

    Our network returned to absolute normalcy the moment we took that cable out of the network. Positive!

    We have had virus attacks which we isolated in comparitively quick time with a packet sniffer - and managed to quarantine the computer.

    This one completely beats us.

    Once again, I thank you for the trouble you have taken to address our problem.

    I will definitely look at the bad packets counter and see if there's anything unusual.

    Best wishes

    Iyer
  • B

    BlackICE_A00

    9 Posts

    344

    0

    Posted December 14th, 2005 22:00

    I believe this would be a loop in the network. Powerconnect use standard STP, but for some product, it use own STP, like cisco 2950. so, if someone loop the powerconnect with those device, the STP can not work and cased whole network down.

Dell Support Resources

Latest Solutions

View More