Broadcast / unicast ratio

Hi there,

what is the "normal" Broadcast / Unicast ratio in Network with around 250 Nodes. The network consists of Servers, Workstations, Printers and there are no Vlans in place. I need some kind of advise how to find out what is an acceptable rate of broadcasts in a Network like this.

Thanks...Andy

Reply to
Andy
Loading thread data ...

sorry forgot to add: it is a fully switched network. ">

Reply to
Andy

There is no such universal number.

All that matters is:-

- Is the level of broadcasts using excessive CPU resources on any connected device.

- Is the user traffic getting through sufficiently unimpeded.

The number of broadcasts recorded on interface counters is often surprisingly high since they can go on for 24 hours a day seven days a week.

If there is something specific that you think is not working properly then please let us know. Specify network topology and equipment used.

Reply to
bod43

worry about subnet size - most broadcasts do not cross a router / L3 switch subnet boundary. Also worry about all "non unicast" since that can be a lot more than just broadcasts........

The network consists of Servers, Workstations, Printers and there

i am with bod43 - this isnt really a useful statistic.

worry about the rate of broadcasts / multicasts arriving at a device. If it generates too much load on the worst case device, then it is too high.

FWIW the most sensitvie devices tend to be those where bandwidth is limited, or with restricted CPU - print servers and wireless access points are the ones i have had to worry about, but YMMV.

i would expect to see peaks when things go a bit unstable (M$oft browsing elections can hurt). Look at the 10% peak rates over a few sec average (if you have the tools to see that), and the long term rate when most devices are in use - often late morning in an office type setup.

it depends where you measure it, but worry about rate of packets since that is what gives the load.

for a port with no active device, then all you get is broadcasts and unknown dest unicast (and maybe the odd unicast frame to a timed out MAC).

finally - subnet sizes are often chosen to make the addressing scheme "neat" - it sounds like you have a 255.255.255.0 mask.

Reply to
Stephen

thanks for your thoughts.

What kind of tools do you suggest for this kind of network analysis. I know whireshark but what else would you suggest.

thanks...Andy

Reply to
Andy

OK. Let me guess.

On Christmas Day you ate a lot of chicken, pototoes, sprouts, pudding, cream and marzipan. Followed by cheese, cigars and Brandy.

Then you had a dream! Broadcast ratio!

I suggest you go and see a doctor.

More seriously, I have the idea that you have something that is worrying you but you have not yet spat it out. Until you do there is not much anyone can say.

As regards analysis try a sh int.

Reply to
bod43

wireshark is great when you know what or where to look - for looking at general load you need more general management.

what it may be good for is artifically loading up the background - if you can load by 100x what is normally there and nothing breaks then you have plenty of headroom.

Note - if you do break it then you may have some unhappy users, so do not test during a critical period, and ideally when everyone has gone home but left all the machines on.

classic way to look at stats is some sort of SNMP management tool to collect stats - find something with an eval period or free for use if you dont want to spend on this inititally.

i dont get involved in this side much any more, but SNMPc was pretty good a couple of versions back:

formatting link

you may have too much background broadcast / multicast if you get disconnect / resets reboots without any good reasons.

if you can look at CPU load on sensitive devices then that will tell you what to ignore - 10% load when idle and peak broadcast load is there is fine.

what you need are managed switches hooking everything up, so that there is instrumentation in place to look at stats in the future.

Reply to
Stephen

One of Wireshark's many features is the IO Graph. You can assign a different coloured histogram to each filter and plot them against each other. So you do have to have a rough idea of what you're looking for, but it can get you a breakdown of what the network load is. For longer-term monitoring you might want to look at NBAR if your devices support it.

Reply to
alexd

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.