what is the "normal" Broadcast / Unicast ratio in Network with around 250 Nodes. The network consists of Servers, Workstations, Printers and there are no Vlans in place. I need some kind of advise how to find out what is an acceptable rate of broadcasts in a Network like this.
worry about subnet size - most broadcasts do not cross a router / L3 switch subnet boundary. Also worry about all "non unicast" since that can be a lot more than just broadcasts........
The network consists of Servers, Workstations, Printers and there
i am with bod43 - this isnt really a useful statistic.
worry about the rate of broadcasts / multicasts arriving at a device. If it generates too much load on the worst case device, then it is too high.
FWIW the most sensitvie devices tend to be those where bandwidth is limited, or with restricted CPU - print servers and wireless access points are the ones i have had to worry about, but YMMV.
i would expect to see peaks when things go a bit unstable (M$oft browsing elections can hurt). Look at the 10% peak rates over a few sec average (if you have the tools to see that), and the long term rate when most devices are in use - often late morning in an office type setup.
it depends where you measure it, but worry about rate of packets since that is what gives the load.
for a port with no active device, then all you get is broadcasts and unknown dest unicast (and maybe the odd unicast frame to a timed out MAC).
finally - subnet sizes are often chosen to make the addressing scheme "neat" - it sounds like you have a 255.255.255.0 mask.
On Christmas Day you ate a lot of chicken, pototoes, sprouts, pudding, cream and marzipan. Followed by cheese, cigars and Brandy.
Then you had a dream! Broadcast ratio!
I suggest you go and see a doctor.
More seriously, I have the idea that you have something that is worrying you but you have not yet spat it out. Until you do there is not much anyone can say.
wireshark is great when you know what or where to look - for looking at general load you need more general management.
what it may be good for is artifically loading up the background - if you can load by 100x what is normally there and nothing breaks then you have plenty of headroom.
Note - if you do break it then you may have some unhappy users, so do not test during a critical period, and ideally when everyone has gone home but left all the machines on.
classic way to look at stats is some sort of SNMP management tool to collect stats - find something with an eval period or free for use if you dont want to spend on this inititally.
i dont get involved in this side much any more, but SNMPc was pretty good a couple of versions back:
formatting link
you may have too much background broadcast / multicast if you get disconnect / resets reboots without any good reasons.
if you can look at CPU load on sensitive devices then that will tell you what to ignore - 10% load when idle and peak broadcast load is there is fine.
what you need are managed switches hooking everything up, so that there is instrumentation in place to look at stats in the future.
One of Wireshark's many features is the IO Graph. You can assign a different coloured histogram to each filter and plot them against each other. So you do have to have a rough idea of what you're looking for, but it can get you a breakdown of what the network load is. For longer-term monitoring you might want to look at NBAR if your devices support it.
Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here.
All logos and trade names are the property of their respective owners.