http://www.dslreports.com/forum/r20435992 en Tue, 02 Dec 2008 05:32:48 EDT Tue, 02 Dec 2008 05:32:48 EDT http://www.dslreports.com/forum/remark,20441380 fox7 : joeMI:
If you take an application like WireShark you can see the IP that the traffic is coming from and the IP that it is going to and what protocol it is.

WireShark is free:
»www.wireshark.org/

I used WireShark, then called Ethereal, to find that alot of traffic on our network was coming from the mentioned 'Printers' by GreenWood.

fox7]]> http://www.dslreports.com/forum/remark,20441380 Tue, 06 May 2008 17:37:45 EDT http://www.dslreports.com/forum/remark,20439691 vpoko : Don't forget that hubs make your network subject to the 5-4-3 rule while a purely switched network isn't.

»www.webopedia.com/TERM/5/5_4_3_rule.html]]> http://www.dslreports.com/forum/remark,20439691 Tue, 06 May 2008 12:33:42 EDT http://www.dslreports.com/forum/remark,20436269 joeMI : Thank you very much for the quick replies.

I agree there should be no hubs and I'm trying to convince my client to do that.

I never thought about the printers. That's an excellent place to start. In off-hours, I'll have to unplug some things to find the culprit(s).

Right now, the network is very chatty, as you say.

Thanks again,
Joe
--
HughesNet | Business Internet plan | HN7000S | .98m/2W dish | 91W:1050MHz | 65 signal | ACP 82 | 1150Kbps/80Kbps]]> http://www.dslreports.com/forum/remark,20436269 Mon, 05 May 2008 18:54:29 EDT http://www.dslreports.com/forum/remark,20435992 anon : One thing to watch for, is devices (printers, mostly) which by default have Appletalk, Netware, Vines, NetBIOS, etc. turned on, some of these are very chatty protocols which will generate a lot of broadcasts even if no computer is using them.

A Netware enabled printer will issue SAP packets forever, hoping to find a print server to attach to. »docsrv.sco.com/SDK_netware/SAP_P···ure.html

I would turn off all protocols no one is using, and see if the broadcasts diminish.]]> http://www.dslreports.com/forum/remark,20435992 Mon, 05 May 2008 18:04:35 EDT http://www.dslreports.com/forum/remark,20435940 anon : (There is never any financial excuse to use hubs on a commercial network, the only reason to ever have one is to snoop packets)

S1) Switch2 will drop packets from Hub1 that resolve to a MAC address on Hub1. No other port on Switch2 will see packets for Hub1 that are already in Switch2's ARP table.

s2) Switch2 will bridge (not route) packets for a Mac Address on Switch1 to the port Switch1 is attached to. Switch1 will bridge (not route) packets for a Mac Address on Switch1 to the port the device is attached to.

A Hub is a multiport repeater, a switch is a multiport bridge. All broadcasts packets always light up every port, unicast packets to a MAC Address not in the ARP table light up every port. In general, it is the second through N packets that knows which port responded, so only lights up one port.]]> http://www.dslreports.com/forum/remark,20435940 Mon, 05 May 2008 17:55:39 EDT http://www.dslreports.com/forum/remark,20435892 shdesigns : Switches maintain the MAC addresses of devices downstream of each port and only send packets out ports with devices that match the MAC address.

When a switch receives a packet from a hub, it is no different than when it receives it from a PC. It looks to see where it needs to go and sends it there.]]> http://www.dslreports.com/forum/remark,20435892 Mon, 05 May 2008 17:47:33 EDT http://www.dslreports.com/forum/remark,20435181 joeMI : I understand the basic difference between a hub and a switch. What I don't understand is what happens when switches and hubs are connected together.

Firewall
|
|
Switch1 -------Switch3------Hub2
|
|
|GB
|uplink
|
|
Switch2
|
|
Hub1

Scenario 1
----------

If a computer on hub1 is communicating with a computer on hub1, I understand that hub1 will broadcast the traffic to all of it's ports. (That's what a hub does.)

Will switch2 see that the destination is on hub1 and ignore the packet? Or, will switch2 be forced to deliver the packet all of it's ports and eventually the entire network?

Scenario 2
----------

If a computer on hub1 is communicating with a computer on switch 1, I understand that hub1 will broadcast the traffic to all of it's ports.

Will switch2 see that the destination is switch1 and direcly route the traffic there?

Will switch1 see that the destination is a port on itself and directly route the traffic to the specific port?

Bottom-line, if a network has hubs at its outer spokes, do the switches intervene and stop the broadcasting of every network packet (that originates on a hub) to all network destinations? Or, once a broadcast message is created by a hub is goes to the entire network no matter what?

Just trying to figure out how deadly hubs are to a mixed environment. When I watch switch1, I can see individual connections and data flowing (which makes sense) but then all port lights flash together in unison a lot, like several times a second. Just wondering if that's normal or the result of having hubs on the network too.

Thank you in advance for any information you can provide.
Joe
--
HughesNet | Business Internet plan | HN7000S | .98m/2W dish | 91W:1050MHz | 65 signal | ACP 82 | 1150Kbps/80Kbps]]> http://www.dslreports.com/forum/remark,20435181 Mon, 05 May 2008 15:41:11 EDT