Network speed is too slow to find the "murderer" behind the switch port (1)

Friend, have you ever encountered a situation where your network is slowly paused, but all the switch ports are continuously sending data. You must have the feeling that the computer on the network is abnormal or even under attack. What should you do?

I think the first step is to enable the network protocol analyzer and capture the data sent from the core router. From the protocol analyzer, you can see that the data package of an IP address is flooding your network with immeasurable traffic. From its data packets, you can get its MAC address. How do you find the location of this computer.

You must know that this computer must be connected to a port of the switch in the IDC. If we can point out the port on which a MAC address is located, you can confirm the computer, disable the port on the switch, locate the computer directly in its office, and disable it.

Here are some methods that can help us find out which device is connected to a port of a Cisco switch:

Method 1: Use a device called Port Tracker

We recommend a device, porttracker. Porttracker is an easy-to-use device that helps us design, validate, and review computer networks. It is also a simple and effective way to check the vswitch and report which network devices are connected to the port of the vswitch. It maps your network to you. This device can solve three problems: (1) unused ports (porttracker treats them as a waste of ports) (2) reduce downtime and know "what connections" (3) Identify ports at risk

Porttracker URL: http://www.porttracker.com/

Method 2: Use Application Software

There are many applications that can help us achieve this purpose. The following are some good software I think:

Managed Switch Port Mapping: This software uses the SNMP protocol to communicate with the Switch and can find out which device is connected to which Port. It can work with vswitches of different brands to display VLAN allocation and export it as a workbook. The current price is USD 199. However, you can download a 15-day trial to see if it works. The interface is as follows: