欢迎访客 ( 登陆 | 注册 )

NetBuddy.Org论坛 ->技术论坛 ->网络世界
论坛索引 | 最新主题 | 热门主题 | 搜索论坛 | 成员列表 | 在线帮助

前往页面: (2) [1] 2  ( 前往第一篇未阅读文章 )
广播风暴？
« 上一篇主题 | 下一篇主题 » 跟踪主题 | 邮寄主题 | 打印主题
  holymonk 离线
1. 广播风暴？
HP : 73 / 738
MP : 411 / 12996
EXP : 55%
名动江湖


成员等级: 30
发表总数: 1235
金币总数: 797
所属组别: 核心成员
注册日期: 2003/01/2

 某一网段用户报告时常有断网情况，
用sniffer抓包，得，



附带图片
发表于2006/07/13, 15:09
     Top
  holymonk 离线
2. Re:广播风暴？
HP : 73 / 738
MP : 411 / 12996
EXP : 55%
名动江湖


成员等级: 30
发表总数: 1235
金币总数: 797
所属组别: 核心成员
注册日期: 2003/01/2

 其中，察看头二个MAC地址


<xxxxxxxx>display mac-address 000e-5e02-86bb
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
000e-5e02-86bb 80 Learned Ethernet0/5 AGING




<XXXXXXX>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT

INDEX AGING TIME
00e0-fc09-bcf9 80 Learned

Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned

GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned

Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned

GigabitEthernet1/1 AGING

附带图片
发表于2006/07/13, 15:13
     Top
  holymonk 离线
3. Re:广播风暴？
HP : 73 / 738
MP : 411 / 12996
EXP : 55%
名动江湖


成员等级: 30
发表总数: 1235
金币总数: 797
所属组别: 核心成员
注册日期: 2003/01/2

 对于 000e-5e02-86bb 还可以理解，这台设备在发广播
但对于 00e0-fc09-bcf9 这个MAC地址怎么可以属于多个端口？
发表于2006/07/13, 15:14
     Top
  holymonk 离线
4. Re:广播风暴？
HP : 73 / 738
MP : 411 / 12996
EXP : 55%
名动江湖


成员等级: 30
发表总数: 1235
金币总数: 797
所属组别: 核心成员
注册日期: 2003/01/2

 忘记说了，设备是华为的3050
发表于2006/07/13, 15:18
     Top
  holymonk 离线
5. Re:广播风暴？
HP : 73 / 738
MP : 411 / 12996
EXP : 55%
名动江湖


成员等级: 30
发表总数: 1235
金币总数: 797
所属组别: 核心成员
注册日期: 2003/01/2

 5分钟后再次察看，端口换了两个
<xxxxxxxxxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/6 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/42 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
发表于2006/07/13, 15:34
     Top
  holymonk 离线
6. Re:广播风暴？
HP : 73 / 738
MP : 411 / 12996
EXP : 55%
名动江湖


成员等级: 30
发表总数: 1235
金币总数: 797
所属组别: 核心成员
注册日期: 2003/01/2

 该MAC地址不断的变换端口
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/2 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/42 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/2 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/42 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/2 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/42 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/9 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/42 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/9 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/42 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/9 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/42 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/9 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/42 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/9 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/42 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/7 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/4 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/4 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/4 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/4 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/4 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/4 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/4 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/4 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/4 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/4 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/4 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned Ethernet0/32 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned Ethernet0/32 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned Ethernet0/32 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>dis mac-address 00e0-fc09-bcf9
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
00e0-fc09-bcf9 80 Learned Ethernet0/11 AGING
00e0-fc09-bcf9 1 Learned GigabitEthernet1/1 AGING
00e0-fc09-bcf9 80 Learned Ethernet0/34 AGING
00e0-fc09-bcf9 1000 Learned GigabitEthernet1/1 AGING
<xxxxxx>
发表于2006/07/13, 16:20
     Top
  麦子 离线
7. Re:广播风暴？
HP : 250 / 1254
MP : 1625 / 21993
EXP : 16%
迟则生变


成员等级: 51
发表总数: 4877
金币总数: 308
所属组别: 管理员
注册日期: 2003/01/9

 追踪一下看看数据包是PC发出来的还是广播风暴复制的？

判断：
display mac-address interface e0/6
如果是PC，一般这个端口下面只有一个MAC地址（病毒、集群等特殊情况下也可能有多个）；如果下面接的是交换机/HUB，一般会有几个MAC地址。
如果接的是PC，由病毒引起的可能性就比较大；如果都是交换机/HUB，有可能是广播风暴，应该继续追踪。


user posted image
没有谁能像一座孤岛/在大海里独踞/每个人都像一块小小的泥土/连接成整个陆地/如果一块泥土被海水冲去/欧洲将缺其一隅/这如同一座山岬/也如同你的朋友和你自己/无论谁死了/都是自己的一部分在死去/因为我包含在人类这个概念里/因此我从不问丧钟为谁而鸣/它为我，也为你
No man is an Island, entire of itself; every man is a piece of the Continent, a part of the main; if a clod be washed away by the sea, Europe is the less, as well as if a promontory were, as well as if a man or of thy friends or of thine own were; any man's death diminishes me, because I am involved in Mankind; And therefore never send to know for whom the bell tolls; It tolls for thee.
发表于2006/07/13, 16:26
          Top
  holymonk 离线
8. Re:广播风暴？
HP : 73 / 738
MP : 411 / 12996
EXP : 55%
名动江湖


成员等级: 30
发表总数: 1235
金币总数: 797
所属组别: 核心成员
注册日期: 2003/01/2

 <xxxxxxxx>dis mac-address interface Ethernet0/5
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME
000d-8846-e814 80 Learned Ethernet0/5 AGING
000d-6196-fc31 80 Learned Ethernet0/5 AGING
0040-0546-8346 80 Learned Ethernet0/5 AGING
0040-0547-2579 80 Learned Ethernet0/5 AGING
000e-5e02-86bb 80 Learned Ethernet0/5 AGING
00e0-4ce1-4fe8 80 Learned Ethernet0/5 AGING

--- 6 mac address(es) found on port Ethernet0/5 ---


这个网络比较混乱，物理上我也无法判断ethernet0/5下接的是PC还是HUB，，，，，个人判断是接了个HUB，然后接了几个PC
发表于2006/07/13, 16:47
     Top
  麦子 离线
9. Re:广播风暴？
HP : 250 / 1254
MP : 1625 / 21993
EXP : 16%
迟则生变


成员等级: 51
发表总数: 4877
金币总数: 308
所属组别: 管理员
注册日期: 2003/01/9

 隔点时间重复执行几次这个命令，观察一下。

作为基础，整理一下网络拓扑的确是必要的。


user posted image
没有谁能像一座孤岛/在大海里独踞/每个人都像一块小小的泥土/连接成整个陆地/如果一块泥土被海水冲去/欧洲将缺其一隅/这如同一座山岬/也如同你的朋友和你自己/无论谁死了/都是自己的一部分在死去/因为我包含在人类这个概念里/因此我从不问丧钟为谁而鸣/它为我，也为你
No man is an Island, entire of itself; every man is a piece of the Continent, a part of the main; if a clod be washed away by the sea, Europe is the less, as well as if a promontory were, as well as if a man or of thy friends or of thine own were; any man's death diminishes me, because I am involved in Mankind; And therefore never send to know for whom the bell tolls; It tolls for thee.
发表于2006/07/13, 17:06
          Top
  holymonk 离线
10. RE: 广播风暴？
HP : 73 / 738
MP : 411 / 12996
EXP : 55%
名动江湖


成员等级: 30
发表总数: 1235
金币总数: 797
所属组别: 核心成员
注册日期: 2003/01/2
QUOTE
隔点时间重复执行几次这个命令，观察一下。

作为基础，整理一下网络拓扑的确是必要的。

执行了几次，结果一样，
发表于2006/07/13, 17:20
     Top
  holymonk 离线
11. Re: RE: 广播风暴？
HP : 73 / 738
MP : 411 / 12996
EXP : 55%
名动江湖


成员等级: 30
发表总数: 1235
金币总数: 797
所属组别: 核心成员
注册日期: 2003/01/2

 000e5e0286bb



附带图片
发表于2006/07/13, 17:22
     Top
  holymonk 离线
12. Re: Re: RE: 广播风暴？
HP : 73 / 738
MP : 411 / 12996
EXP : 55%
名动江湖


成员等级: 30
发表总数: 1235
金币总数: 797
所属组别: 核心成员
注册日期: 2003/01/2

 huawei09bcf9

附带图片
发表于2006/07/13, 17:24
     Top
  holymonk 离线
13. Re:广播风暴？
HP : 73 / 738
MP : 411 / 12996
EXP : 55%
名动江湖


成员等级: 30
发表总数: 1235
金币总数: 797
所属组别: 核心成员
注册日期: 2003/01/2

 heihei,下班，回家，明天继续
发表于2006/07/13, 17:24
     Top
  holymonk 离线
14. Re: Re:广播风暴？
HP : 73 / 738
MP : 411 / 12996
EXP : 55%
名动江湖


成员等级: 30
发表总数: 1235
金币总数: 797
所属组别: 核心成员
注册日期: 2003/01/2

 还有一张

附带图片
发表于2006/07/13, 17:26
     Top
  麦子 离线
15. RE: 广播风暴？
HP : 250 / 1254
MP : 1625 / 21993
EXP : 16%
迟则生变


成员等级: 51
发表总数: 4877
金币总数: 308
所属组别: 管理员
注册日期: 2003/01/9
QUOTE
QUOTE
隔点时间重复执行几次这个命令，观察一下。

作为基础，整理一下网络拓扑的确是必要的。

执行了几次，结果一样，


结果都一样的话一般接的是HUB/Switch，应该不是PC。


user posted image
没有谁能像一座孤岛/在大海里独踞/每个人都像一块小小的泥土/连接成整个陆地/如果一块泥土被海水冲去/欧洲将缺其一隅/这如同一座山岬/也如同你的朋友和你自己/无论谁死了/都是自己的一部分在死去/因为我包含在人类这个概念里/因此我从不问丧钟为谁而鸣/它为我，�