Router and ARP flooding

Quote:

---

Regarding the network scheme, I've a Cisco Cat3550, which provides routing between 4 different networks, 196.1.64.0/24, 196.1.65.0/24, 196.1.67.0/24 and 172.16.0.0/16.

---

The C - class subnets are just fine and will not have much flooding. But it's crazy to have a /16 subnet unsegmented ! How many real hosts are in this subnet anyway ?

If you really have that much hosts in such subnet, then periodic sniffing won't help you cause it'll just be normal everyday request-traffic. I believe the problem is obvious :o

Anyway , good luck,

'

Quote:

---

But it's crazy to have a /16 subnet unsegmented ! How many real hosts are in this subnet anyway ?

---

Amen.

And the number of actuals hosts on that is less than 400.. yup, 400 out of 65,534. Of course, there's also the other security issue of using routable, non-private addresses such as 196.1.x.x. But then, the network's really grown ad hoc, and rite now, I'm supposed to just fix, not mess around. Anyway, the idea at the moment of the higher-ups, is to model the entire network in OPNET [the college got a multiple user license, and are itching to use it], and based on the simulation results, recommend changes, model these changes.. and finally, implement. Its slow, but why'd I complain about getting free opnet classes? ;-) Right, I guess thats enough banter from my end... back to work.

Scim

Okay, there's 3Com Network Inspector running on one of the machines in the 196.1.67.0 Network, that every 12 hours discovers/updates the entire network diagram. For the 172.16.0.0/16 Net, it pings each and every possible IP on that net. Hence the router sending incessant ARPs.

However, one more thing, ethereal shows the source IP for these arps as 196.1.64.253 [which is the default gw for the 196.1.64.0 net], instead of 196.1.67.253 [the default gw for 196.1.67.0 Net]. The machine running 3Com NI is on the 196.1.67.0 network. Shouldn't the source hence be 196.1.67.253 ? If I'm not being clear, please let me know.

To recap the college network, 4 different networks - 172.16.0.0/16, 196.1.65.0/24, 196.1.64.0/24, and 196.1.67.0/24.

Thanx
Scim

Here is what I would do.

1) Scrap everything and start over with a solid design that contains a bunch of class C segments. Use a router and a switch (I assume a router in each building) at each location and have all of those routers feed into your 3550. This will:

a) Remove the horrible issue you have with a /16 mungo range.
b) Provide a logical design for management and growth.
c) Cut down on tons of ARP traffic on the *entire* WAN. You'll still see normal updates but they will be localized.

While you are at it, for God sake man, use RFC 1918 and ditch the damn public address schemes! Using public addresses on a private network can cause all sorts of DNS fun if you have the right circumstances. Things like yahoo resolving to an internal server, etc.

I would use VLANs only if necessary. While they certainly are useful, many times jr. techs seem to dismiss the idea that certain ports on a switch/router do different things and unless you are hardass about documentation, you're bound to run into someone throwing a host on the wrong segment when patching them in.

Seems like you have a Cisco shop. May I suggest getting CiscoWorks to manage your environment.

Hi all,

most of the things have already been said , so far about arp storming and ad hoc growth , and 1918 and 196..... , honestly thatz how most of the times networks grow.

I have seen many many networks that ways... here are a few things u should look at immediately..

1 Ciscoworks might sound expensive proposal, try www.solarwinds.net , download 1 copy of Engineers edition and that will last for 1 month atleast...( enough time to resolve current things).

2 As horse stated , restructing from scratch, might not be practically viable, but you surley
can choose a small area, rectify it ( work on its archt. carrefully) identify the traffic flow, the best designed network is were you know how the traffic flows.

Try and use hierarchy for designing your network, believe me you will be able to sleep w/o thinking of your network :-).

regards.