win brodcast

Hi, One of my remote site has been experience slowness problem after the xp2 refresh. SoI monitor the traffic by using debug ip packet detail and below is the output from the debug and I find many win broadcast. Can someone tell me it is normal and why I am seeing so many win broadcast. jrd_60laff#no debug all100), d=172.16.106.191 (Ethernet0), g=172.16.106.191, len 41, forward

*Mar 1 22:21:31: TCP src=524, dst=1446, seq=564966808, ack=2194933790, win= 7604 ACK *Mar 1 22:21:31: IP: s=65.143.227.74 (Serial1.100), d=172.16.106.52 (Ethernet0) , g=172.16.106.52, len 28, forward *Mar 1 22:21:31: ICMP type=8, code=0 *Mar 1 22:21:31: IP: s=65.143.227.74 (Serial1.100), d=172.16.106.52 (Ethernet0) , len 28, encapsulation failed *Mar 1 22:21:31: ICMP type=8, code=0 *Mar 1 22:21:31: %SEC-6-IPACCESSLOGDP: list 120 denied icmp 172.16.106.158 -> 1 72.16.91.105 (0/0), 1 packet *Mar 1 22:21:31: IP: s=172.16.106.158 (Ethernet0), d=172.16.91.105, len 84, acc ess denied *Mar 1 22:21:31: ICMP type=8, code=0 *Mar 1 22:21:31: IP: s=172.16.106.1 (local), d=172.16.106.158 (Ethernet0), len 56, sending *Mar 1 22:21:31: ICMP type=3, code=13 *Mar 1 22:21:31: IP: s=172.16.5.204 (Serial1.100), d=172.16.106.191 (Ethernet0) , g=172.16.106.191, len 41, forward *Mar 1 22:21:31: TCP src=524, dst=1446, seq=564966808, ack=2194933790, win= 7604 ACK *Mar 1 22:21:31: IP: s=172.16.106.191 (Ethernet0), d=172.16.5.204 (Serial1.100) , g=172.16.246.81, len 40, forward *Mar 1 22:21:31: TCP src=1446, dst=524, seq=2194933790, ack=564966809, win= 63924 ACK *Mar 1 22:21:31: IP: s=172.16.106.158 (Ethernet0), d=172.16.111.102, len 84, ac cess denied *Mar 1 22:21:31: ICMP type=8, code=0 *Mar 1 22:21:31: IP: s=172.16.106.191 (Ethernet0), d=172.16.5.204 (Serial1.100) , g=172.16.246.81, len 40, forward *Mar 1 22:21:31: TCP src=1446, dst=524, seq=2194933790, ack=564966809, win= 63924 ACK *Mar 1 22:21:33: %SEC-6-IPACCESSLOGDP: list 120 denied icmp 172.16.106.158 -> 1 72.16.91.99 (0/0), 1 packet *Mar 1 22:21:33: IP: s=172.16.106.158 (Ethernet0), d=172.16.91.99, len 84, acce ss denied *Mar 1 22:21:33: ICMP type=8, code=0 *Mar 1 22:21:33: IP: s=172.16.106.1 (local), d=172.16.106.158 (Ethernet0), len 56, sending *Mar 1 22:21:33: ICMP type=3, code=13 *Mar 1 22:21:33: IP: s=172.16.106.158 (Ethernet0), d=172.16.91.96, len 84, acce ss denied *Mar 1 22:21:33: ICMP type=8, code=0 *Mar 1 22:21:33: IP: s=172.16.106.1 (local), d=224.0.0.10 (Ethernet0), len 60, sending broad/multicast, proto=88 *Mar 1 22:21:33: IP: s=172.16.246.81 (Serial1.100), d=224.0.0.10, len 60, rcvd 2, proto=88 *Mar 1 22:21:34: %SEC-6-IPACCESSLOGDP: list 120 denied icmp 172.16.106.158 -> 1 72.16.91.76 (0/0), 1 packet *Mar 1 22:21:34: IP: s=172.16.106.158 (Ethernet0), d=172.16.91.76, len 84, acce ss denied *Mar 1 22:21:34: ICMP type=8, code=0 *Mar 1 22:21:34: IP: s=172.16.106.1 (local), d=172.16.106.158 (Ethernet0), len 56, sending term mon22:21:34: ICMP type=3, code=13 *Mar 1 22:21:34: IP: s=172.16.246.82 (local), d=224.0.0.10 (Serial1.100), len

Hi,

The output displayed below doesn't contain any broadcasts! The win= fields in the output gives you information about the window position/size. This is part of TCP/IP flow-control / error-handling. What the output actually displays is a lot of ICMP traffic (echo-request (ping) and destination unreachable), some NCP (port 524, novell control protocol) messages and some (E)IGRP helo's.

All of this is done in 0.02 seconds, what's the current used bandwith on the interface. See show interfaces and look for the bytes / s send and received. Your trace included NCP? Are you running Novell? If not, you might want to run a spyware / antivirus scan. A google search for "tcp port 524" shows various security related results.

Regards,

Erik