ellem's Journal: [ASK /.] Monitoring Unmanaged Switches

In an attempt to monitor some flakey DELL switches I have hooked them into some CISCO 2960s.

So now I monitor the ports the Dells are in and now I am wondering what I should really be looking for... surely I have sniffers and such to use.

What should I be looking for PRIOR to a packet storm?

Packet storms

[Iamthefallen]

What should I be looking for PRIOR to a packet storm?

Bread, toilet paper, and milk?

Notwork

[ces]

I'd look for ethernet framing errors.

Past that I'd see if the switches, even though they are supposed to be dumb unmanaged switches, supported RMON or SNMP trap generation. Without that it is going to be really hard to diagnose what is going on.

In the past I've had any suspect unamanaged switches sent in for warranty work or I've given them over to applications (test lab, etc) where reliablity really wasn't a concern.

As a final note I won't reccomend unmanaged switches for anything other than desktop type a

Re:

[ellem]

Yeah I am replacing them as fast as my budget will allow. I'm just trying to minimize the damage they are likely to do.

Re:

[ces]

BTW if you are currently buying Cisco switches you can stretch that budget quite a bit further by getting HP procurve kit. I see no real advantages to buying Cisco over HP at least in the low to midrange of both lines. In fact I've been given considerable grief by Cisco's gear in the past due to their inablity to play nice with anything other than Cisco gear when autonegotiating duplex on 100bT.

sounds like a simple question

[artifex2004]

but there's no simple answer. It could be framing issues, or it could be anything up to some app layer protocol or virus spewing trying to locate neighbors, or down to bad cabling, or something weird like someone setting up RIP or something by accident.
When you see the packet storm, is it across all ports, or just some ports, of the affected switch?
Is there a regular pattern to the storms? Like every 30 seconds, etc.?
When you move devices on those ports to another switch, or to different ports, does the pro

You should be

[ryanr]

You should be double-checking that you can actually sniff when a problem occurs. Maybe if you want to be complete, arrange to keep copies of all packets crossing the port, or maybe a window of packets (last hour or some such.) Finally, maybe by way of checking that you can sniff, see if there is any general weirdness on the net. It's not flawless, but Ethereal has some built-in problem checks you can try.

So what's the original problem you're trying to catch? "Packet storm" isn't terribly specific.