Slashdot Mirror
Finding the Truth Behind Cable Modem Traffic Bursts?
Techi asks: "I help to support a small cable modem network in Kansas, and we keep having recurring problems with all the modems in a node bursting extreme amounts of traffic for a period of about 30 seconds. At the end of this 30 second period, the upstream port that the node in question is connected to dies under the pressure. We have recently implemented a fix to keep people from uncapping modems in the form of a config file update from our DHCP system. I know we could have done it differently, but it wasn't my decision. Does anyone have any idea what could be causing 70 or so modems at a time to suddenly erupt with outgoing traffic nonstop until the upstream dies?"
one word: DOS
fp?
Sounds like a broadcast storm to me..
One (misconfigured) machine broadcasts data (say, NMB update) with a source address of the broadcast address - everybody on the segment replies, (which causes everybody on the segment, including the misconfigured one to reply again, ad infinitum) - result: segment meltdown.
As someone else pointed out, a traffic monitor would be your best bet - you don't need to capture all of it, just the first part, to see what's starting it up - then you can decide what to do.