3.2.1 network loop should not be fault-tolerant

An improper port connection between switches in the Ethernet may cause a network loop. If the related switch does not enable the STP function, this loop will lead to endless repeated packet forwarding, forming a broadcast storm, this causes network faults. We have encountered such a fault many times during the maintenance of the campus network, and we were impressed by the troubleshooting process.
Fault description
One day, we found a problem with a VLAN in the campus network performance monitoring platform-the connection between the access switch and the campus network was interrupted. Check the aggregation switch placed in the network center. It is measured that the 100BASE-FX port connected to it has a large amount of inbound traffic, but the outbound traffic is very small, which seems abnormal. However, the performance of this aggregation switch seems to be okay and there is no problem. Therefore, we mirror the abnormal port on this aggregation switch and use the protocol analysis tool Sniffer to capture packets. At most, we can capture more than 0.1 million packets per second. Perform a simple analysis on these packets, and we find some of them are shown in common feature 1 ).

Figure 1 packet capture data

The vast majority of packets are 62 bytes plus 4 bytes for error detection. The FCS domain is 66 bytes), and the TCP status is SYN.
The source IP address is the IP address of another CIDR block, and the destination IP address is the IP address of the CIDR Block of the building.
Although the source IP address is different, the source MAC address is the same.
The destination IP address and destination MAC address are the same as the IP-MAC parameters bound to the VLAN on this aggregation switch.
The actual data flow direction) is opposite to the flow direction determined by the source IP address and destination IP address in these packets.
At that time, we were eager to repair the network as soon as possible and did not go into the characteristics of these data packets. We only saw 1st points and thought the network was under an unknown Syn Flood attack. It was estimated that it was caused by a new network virus, immediately disable the port on the aggregation switch to avoid network performance degradation.

BibliographyPrevious sectionNext section