Re: Excessive network traffic -

[Gordon Messmer <yinyang@xxxxxxxxx>]

Phil Meyer wrote:
> What happens is that a 'switch' is supposed to look one level deeper 
> into each packet than a bridge does, and determine which interface to 
> copy it to.  A bridge simply copies every packet to every interface.
>
> Packet flooding happens when the switch does not have enough memory or 
> CPU to examine every packet.  For those packets it cannot examine, it 
> drops them on every interface, like a bridge would do.

The behavior you're describing is not possible with broadcast packets, 
like ARP.

An ARP packet is an ethernet packet with a broadcast destination 
address, and information about a higher-level network protocol (IPv4) 
address for which the sender wants an ethernet address.

Once the sender has the ethernet address (MAC), it can send network 
packets directly to that host.  Each of those packets will be an IPv4 
packet wrapped in an ethernet packet.  The ethernet packet will have the 
sender's MAC and the destination MAC.  Now, if a switch does not know 
which on which port it will find the destination MAC (such as when its 
memory is insufficient to keep a complete list), then it will send the 
packet to all interfaces.

That's not what's happening in this case, though.  ARP packets are 
specifically broadcast, and must be sent to all ports.  There's nothing 
unusual about this.  Every host with an ethernet connection will see a 
relatively constant stream of ARP traffic from the hosts on its network.