Fedora Users — Re: Excessive network traffic -

Re: Excessive network traffic -

Date Prev

Date Next

Thread Prev

Thread Next

Date Index

Thread Index

Phil Meyer wrote:

What happens is that a 'switch' is supposed to look one level deeperinto each packet than a bridge does, and determine which interface tocopy it to. A bridge simply copies every packet to every interface.
Packet flooding happens when the switch does not have enough memory orCPU to examine every packet. For those packets it cannot examine, itdrops them on every interface, like a bridge would do.

The behavior you're describing is not possible with broadcast packets,like ARP.

An ARP packet is an ethernet packet with a broadcast destinationaddress, and information about a higher-level network protocol (IPv4)address for which the sender wants an ethernet address.

Once the sender has the ethernet address (MAC), it can send networkpackets directly to that host. Each of those packets will be an IPv4packet wrapped in an ethernet packet. The ethernet packet will have thesender's MAC and the destination MAC. Now, if a switch does not knowwhich on which port it will find the destination MAC (such as when itsmemory is insufficient to keep a complete list), then it will send thepacket to all interfaces.

That's not what's happening in this case, though. ARP packets arespecifically broadcast, and must be sent to all ports. There's nothingunusual about this. Every host with an ethernet connection will see arelatively constant stream of ARP traffic from the hosts on its network.