Broadcast STORM: behind the scenes that cause network congestion (1)

In a LAN Internet sharing environment, we often encounter slow network transmission speeds, webpage access failure, and even network paralysis, most of the reasons for this are network channel congestion. What causes serious network congestion? Is the content transmitted over the network too large? Is it a broadcast storm in a lan? Or a virus or Trojan on the network?

Many network channel congestion failures are often accompanied by slow access to the Internet or inability to access the Web page. I suggest that you solve the problem in the case of a network fault similar to this problem and troubleshoot the problem step by step, this will cause the network channel to be blocked. Now, let's take a look at the author's experience in identifying the "Black Hands" behind the scenes of network congestion.

Problem: new workstation strikes on the network

The person in charge of the training center of the Organization recently asked the author for help. Due to business expansion needs, the training center has bought eight new workstations and connected all the new workstations to the LAN; however, when using the new workstation to access the Internet, there was a very strange phenomenon. When there were very few people surfing the internet in the training center, all the workstations were working normally; if more than six people share the Internet at the same time in the LAN, all newly added workstations will be automatically disconnected, not only unable to access the webpage, but also cannot play online games in the intranet.

Unexpectedly, when the network administrator of the training center unconnects the network connection cables of All workstations in the switch and re-inserts them in turn, all the newly added workstations can access the Internet normally. After receiving such a rare fault "Seeking for help", the strong curiosity drove the author to decide to go to the fault site to find out.

Why is it not caused by a virus?

The Organization training center has been holding various levels of computer training and network training for the society for a long time. This person in charge has not taken over the Organization training center for a long time, in the past, many workstations in the training equipment room were outdated. To improve the competitiveness of the training, the person in charge bought these eight workstations.

In order to allow the newly purchased workstation to quickly access the LAN of the organization for Internet sharing, the training center buys another switch and cascade the new switch to the main switch in the LAN, then, all the newly purchased workstations are connected to the new switch, while some old workstations in the past of the training center are connected to the main switch of the LAN through an old switch, workstations on different vswitches are in two different working subnets.

After learning about the network topology of the training data center, I think this network fault is not very likely caused by viruses or Trojans. After all, when the network administrator encounters a fault where the network is inaccessible, after the network connection cable in the switch is re-plugged, all new workstations can continue to work normally for a while. If the new work subnet does have viruses or Trojans, network faults cannot automatically disappear after a simple insertion or removal of the network cable.

Isolate to lock the network of the new switch

To check whether a network fault occurs only in the subnet where the new switch is located, only in the subnet where the old switch is located, or in the LAN, I decided to use the isolation method to separately test the Internet sharing situation of each subnet. Just do it. I will first disconnect the new switch from the main switch of the LAN, so that the new workstation is isolated from the LAN, at the same time, all the workstations connected to the old vswitch are powered on and shared Internet access is attempted. It is found that no matter how many workstations are connected to the Internet at the same time, no workstation in the LAN experiences online disconnection. All workstations can perform network transmission and access the Internet page, this indicates that the working subnet of the old switch does not have any problems.

According to the same test method, the author disconnects the old switch from the main switch of the LAN, so that the new switch is connected to the main switch separately, in order to only allow the newly purchased workstation to share the Internet through the lan. During this test, the author found that the working subnet of the new switch works normally when the number of concurrent Internet users is small, however, when more than six new workstations share the Internet through the new switch at the same time, the network transmission speed of the entire working subnet is immediately reduced, and the speed of webpage access is also very slow, sometimes the network page cannot be opened. Based on this test result, the author preliminarily determines that the working subnet of the new switch has a problem.