Wireshark-users: Re: [Wireshark-users] High broadcast traffic
From: "Tom Greaser" <tgreaser@xxxxxxxxxxx>
Date: Thu, 21 Feb 2008 15:57:04 -0500
Hansang Bae asked a great question.
I have hung myself by setting up Mulitcast on a device in a legacy (FAT
LARGE ) network.  In doing so i only thought about L3.. well multicast
uses the same L2 flag as bcast.!!!!!



On Wed, 2008-02-20 at 19:22 -0500, Hansang Bae wrote:
> joans4nz wrote:
> > I'm a network administrator in my new job and when I ran Wireshark I saw 
> > to much ARP traffic level and Ntop show 86% broadcast traffic to.
> > 
> > There are DHCP server and 350 Windows stations. My boss dont know 
> > nothing about networks and I propose to my boss buy a layer 3 switch and 
> > create vlans to reduce the broadcast traffic levels, but my boss ask 
> > what must be the normal levels of broadcast traffic in the LAN network. I have search in google and I can't find a good response 
> > to that question, I feel bad without a good answer and reference.
> > 
> > Could any in the list help me please?
> > 
> > Thanks for your time and excuse my english.
> 
> 
> Is there a problem you want to resolve?  The days of users firing up 
> Doom (pre 1.1) and killing 486 based PCs because of broadcast packets is 
> long gone.  Where did you capture from?  86% of TOTAL traffic on your 
> network is broadcast?  Or just what you are seeing on your port?  Are 
> you running any multicast based apps that is being reported as broadcast?
> 
> The CCDA design numbers Stewart posted is not really something that 
> should guide you.  One can argue all day about legitimacy of those 
> numbers.
> 
>