Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] High broadcast traffic

From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Wed, 20 Feb 2008 19:22:53 -0500
joans4nz wrote:
I'm a network administrator in my new job and when I ran Wireshark I saw to much ARP traffic level and Ntop show 86% broadcast traffic to.

There are DHCP server and 350 Windows stations. My boss dont know nothing about networks and I propose to my boss buy a layer 3 switch and create vlans to reduce the broadcast traffic levels, but my boss ask what must be the normal levels of broadcast traffic in the LAN network. I have search in google and I can't find a good response to that question, I feel bad without a good answer and reference.

Could any in the list help me please?

Thanks for your time and excuse my english.


Is there a problem you want to resolve? The days of users firing up Doom (pre 1.1) and killing 486 based PCs because of broadcast packets is long gone. Where did you capture from? 86% of TOTAL traffic on your network is broadcast? Or just what you are seeing on your port? Are you running any multicast based apps that is being reported as broadcast?

The CCDA design numbers Stewart posted is not really something that should guide you. One can argue all day about legitimacy of those numbers.


--

Thanks,
Hansang