RE: [WISPA] Network Storm
Title: Message It is probably peer to peer traffic. That can take a network down very quickly. You will have to hunt down which user is hammering your network. Probably BitTorrent traffic if I were guessing. W.L. EdwardsCEORNet CommunicationsOffice 765-342-3554Fax 765-349-4880IMPORTANT: Confidentiality Statement:This message is intended only for the use of the Addressee and may containinformation that is PRIVILEGED and CONFIDENTIAL. If you are not theintended recipient, dissemination of this communication is prohibited. Ifyou have received this communication in error, please erase all copies ofthe message and its attachments and notify RNet Communications immediately -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ron WallaceSent: Thursday, August 10, 2006 10:16 AMTo: wireless@wispa.org; [EMAIL PROTECTED]Subject: [WISPA] Network Storm To all, I am having a network storm, the first. All activity light switches on the wireless net are flashing like crazy, both at the data center and customer sites, may not mean much, but it has not happened before. There is a huge amount of traffic on the canopy sys. Others have discussed an ICMP storm w/ a (0.0.0.0) address that comes from Linksys Netgear routers. There are about 20 on my net, of 90 users. I am aknow-nothing at this, and really a hardware/RF guy. Not familiar with Ethereal or other SW that monitors the net. What are you all using? Where do I get it? What are your thoughts and advice? Any help or advice you could offer would be greatly appreciated. I'll do whatever you all advise. Ron Wallace Tigernet Phone: 517-547-8410 Mobile: 517-605-4542 [EMAIL PROTECTED] [EMAIL PROTECTED] -- WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
Re: [WISPA] Network Storm
Thanks Bill. -Original Message-From: William.L. Edwards [mailto:[EMAIL PROTECTED]Sent: Thursday, August 10, 2006 10:26 AMTo: ''WISPA General List'', [EMAIL PROTECTED]Subject: RE: [WISPA] Network Storm It is probably peer to peer traffic. That can take a network down very quickly. You will have to hunt down which user is hammering your network. Probably BitTorrent traffic if I were guessing. W.L. EdwardsCEORNet CommunicationsOffice 765-342-3554Fax 765-349-4880IMPORTANT: Confidentiality Statement:This message is intended only for the use of the Addressee and may containinformation that is PRIVILEGED and CONFIDENTIAL. If you are not theintended recipient, dissemination of this communication is prohibited. Ifyou have received this communication in error, please erase all copies ofthe message and its attachments and notify RNet Communications immediately -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ron WallaceSent: Thursday, August 10, 2006 10:16 AMTo: wireless@wispa.org; [EMAIL PROTECTED]Subject: [WISPA] Network Storm To all, I am having a network storm, the first. All activity light switches on the wireless net are flashing like crazy, both at the data center and customer sites, may not mean much, but it has not happened before. There is a huge amount of traffic on the canopy sys. Others have discussed an ICMP storm w/ a (0.0.0.0) address that comes from Linksys Netgear routers. There are about 20 on my net, of 90 users. I am aknow-nothing at this, and really a hardware/RF guy. Not familiar with Ethereal or other SW that monitors the net. What are you all using? Where do I get it? What are your thoughts and advice? Any help or advice you could offer would be greatly appreciated. I'll do whatever you all advise. Ron Wallace Tigernet Phone: 517-547-8410 Mobile: 517-605-4542 [EMAIL PROTECTED] [EMAIL PROTECTED] -- WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
Re: [WISPA] Network Storm
Ron, Are you seeing icmp to other IP's that are unreachable along with the icmp to 0.0.0.0 ? I have seen this in the past and looked like it was coming from a linksys router. I suspected the router was randomly replying to other's IP's, basically causing loops.To isolate I had to disable different AP's to discover which AP it was originating from, then acl each client until I could isolate to a client, long process in between network hangs. The last time this happened to me 90% of my network was bridged. Now I am 90% routed and have not seen the problem Tim - Original Message - From: Ron Wallace To: WISPA General List ; William.L. Edwards Sent: Thursday, August 10, 2006 7:37 AM Subject: Re: [WISPA] Network Storm Thanks Bill. -Original Message-From: William.L. Edwards [mailto:[EMAIL PROTECTED]Sent: Thursday, August 10, 2006 10:26 AMTo: ''WISPA General List'', [EMAIL PROTECTED]Subject: RE: [WISPA] Network Storm It is probably peer to peer traffic. That can take a network down very quickly. You will have to hunt down which user is hammering your network. Probably BitTorrent traffic if I were guessing. W.L. EdwardsCEORNet CommunicationsOffice 765-342-3554Fax 765-349-4880IMPORTANT: Confidentiality Statement:This message is intended only for the use of the Addressee and may containinformation that is PRIVILEGED and CONFIDENTIAL. If you are not theintended recipient, dissemination of this communication is prohibited. Ifyou have received this communication in error, please erase all copies ofthe message and its attachments and notify RNet Communications immediately -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ron WallaceSent: Thursday, August 10, 2006 10:16 AMTo: wireless@wispa.org; [EMAIL PROTECTED]Subject: [WISPA] Network Storm To all, I am having a network storm, the first. All activity light switches on the wireless net are flashing like crazy, both at the data center and customer sites, may not mean much, but it has not happened before. There is a huge amount of traffic on the canopy sys. Others have discussed an ICMP storm w/ a (0.0.0.0) address that comes from Linksys Netgear routers. There are about 20 on my net, of 90 users. I am aknow-nothing at this, and really a hardware/RF guy. Not familiar with Ethereal or other SW that monitors the net. What are you all using? Where do I get it? What are your thoughts and advice? Any help or advice you could offer would be greatly appreciated. I'll do whatever you all advise. Ron Wallace Tigernet Phone: 517-547-8410 Mobile: 517-605-4542 [EMAIL PROTECTED] [EMAIL PROTECTED] -- WISPA Wireless List: wireless@wispa.orgSubscribe/Unsubscribe:http://lists.wispa.org/mailman/listinfo/wirelessArchives: http://lists.wispa.org/pipermail/wireless/ Internal Virus Database is out-of-date.Checked by AVG Anti-Virus.Version: 7.1.394 / Virus Database: 268.10.1/391 - Release Date: 7/18/2006 Internal Virus Database is out-of-date. Checked by AVG Anti-Virus. Version: 7.1.394 / Virus Database: 268.10.1/391 - Release Date: 7/18/2006 -- WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
Re: [WISPA] Network Storm
Thanks Tim, I'm not sure yet. but how do you mean you are 90% routed? Does each of your APs go directly to a router? I only have one headend, w/ 1 canopy 900 on an omni, 3 canopy 2.45's each on a 120* sector, thats it. They are all plugged into a CMMmicro, from there to a Netgear switch, to a Mikrotik router, to a back haul (tranzeo 5a) to a CLEC fiber for access - its simple but it has worked well, until this mess. -Original Message-From: Tim Kerns [mailto:[EMAIL PROTECTED]Sent: Thursday, August 10, 2006 10:52 AMTo: 'WISPA General List'Subject: Re: [WISPA] Network Storm Ron, Are you seeing icmp to other IP's that are unreachable along with the icmp to 0.0.0.0 ? I have seen this in the past and looked like it was coming from a linksys router. I suspected the router was randomly replying to other's IP's, basically causing loops.To isolate I had to disable different AP's to discover which AP it was originating from, then acl each client until I could isolate to a client, long process in between network hangs. The last time this happened to me 90% of my network was bridged. Now I am 90% routed and have not seen the problem Tim - Original Message - From: Ron Wallace To: WISPA General List ; William.L. Edwards Sent: Thursday, August 10, 2006 7:37 AM Subject: Re: [WISPA] Network Storm Thanks Bill. -Original Message-From: William.L. Edwards [mailto:[EMAIL PROTECTED]Sent: Thursday, August 10, 2006 10:26 AMTo: ''WISPA General List'', [EMAIL PROTECTED]Subject: RE: [WISPA] Network Storm It is probably peer to peer traffic. That can take a network down very quickly. You will have to hunt down which user is hammering your network. Probably BitTorrent traffic if I were guessing. W.L. EdwardsCEORNet CommunicationsOffice 765-342-3554Fax 765-349-4880IMPORTANT: Confidentiality Statement:This message is intended only for the use of the Addressee and may containinformation that is PRIVILEGED and CONFIDENTIAL. If you are not theintended recipient, dissemination of this communication is prohibited. Ifyou have received this communication in error, please erase all copies ofthe message and its attachments and notify RNet Communications immediately -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ron WallaceSent: Thursday, August 10, 2006 10:16 AMTo: wireless@wispa.org; [EMAIL PROTECTED]Subject: [WISPA] Network Storm To all, I am having a network storm, the first. All activity light switches on the wireless net are flashing like crazy, both at the data center and customer sites, may not mean much, but it has not happened before. There is a huge amount of traffic on the canopy sys. Others have discussed an ICMP storm w/ a (0.0.0.0) address that comes from Linksys Netgear routers. There are about 20 on my net, of 90 users. I am aknow-nothing at this, and really a hardware/RF guy. Not familiar with Ethereal or other SW that monitors the net. What are you all using? Where do I get it? What are your thoughts and advice? Any help or advice you could offer would be greatly appreciated. I'll do whatever you all advise. Ron Wallace Tigernet Phone: 517-547-8410 Mobile: 517-605-4542 [EMAIL PROTECTED] [EMAIL PROTECTED] -- WISPA Wireless List: wireless@wispa.orgSubscribe/Unsubscribe:http://lists.wispa.org/mailman/listinfo/wirelessArchives: http://lists.wispa.org/pipermail/wireless/ Internal Virus Database is out-of-date.Checked by AVG Anti-Virus.Version: 7.1.394 / Virus Database: 268.10.1/391 - Release Date: 7/18/2006 -- WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
RE: [WISPA] Network Storm
Ron, Go here to get ethereal: http://www.ethereal.com/download.html Also do you host any of your own servers? If so DDOS attacks are pretty common and if your network is bridged without VLANS you could be having that trouble. At any rate ethereal will tell you whats going on Hit me off list if you need a hand or give me a call 318-376-2562 GL, Mac Dearman From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ron Wallace Sent: Thursday, August 10, 2006 10:41 AM To: WISPA General List; [EMAIL PROTECTED] Subject: Re: [WISPA] Network Storm Thanks Tim, I'm not sure yet. but how do you mean you are 90% routed? Does each of your APs go directly to a router? I only have one headend, w/ 1 canopy 900 on an omni, 3 canopy 2.45's each on a 120* sector, thats it. They are all plugged into a CMMmicro, from there to a Netgear switch, to a Mikrotik router, to a back haul (tranzeo 5a) to a CLEC fiber for access - its simple but it has worked well, until this mess. -Original Message- From: Tim Kerns [mailto:[EMAIL PROTECTED] Sent: Thursday, August 10, 2006 10:52 AM To: 'WISPA General List' Subject: Re: [WISPA] Network Storm Ron, Are you seeing icmp to other IP's that are unreachable along with the icmp to 0.0.0.0 ? I have seen this in the past and looked like it was coming from a linksys router. I suspected the router was randomly replying to other's IP's, basically causing loops.To isolate I had to disable different AP's to discover which AP it was originating from, then acl each client until I could isolate to a client, long process in between network hangs. The last time this happened to me 90% of my network was bridged. Now I am 90% routed and have not seen the problem Tim - Original Message - From: Ron Wallace To: WISPA General List ; William.L. Edwards Sent: Thursday, August 10, 2006 7:37 AM Subject: Re: [WISPA] Network Storm Thanks Bill. -Original Message- From: William.L. Edwards [mailto:[EMAIL PROTECTED] Sent: Thursday, August 10, 2006 10:26 AM To: ''WISPA General List'', [EMAIL PROTECTED] Subject: RE: [WISPA] Network Storm It is probably peer to peer traffic. That can take a network down very quickly. You will have to hunt down which user is hammering your network. Probably BitTorrent traffic if I were guessing. W.L. Edwards CEO RNet Communications Office 765-342-3554 Fax 765-349-4880 IMPORTANT: Confidentiality Statement: This message is intended only for the use of the Addressee and may contain information that is PRIVILEGED and CONFIDENTIAL. If you are not the intended recipient, dissemination of this communication is prohibited. If you have received this communication in error, please erase all copies of the message and its attachments and notify RNet Communications immediately -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ron Wallace Sent: Thursday, August 10, 2006 10:16 AM To: wireless@wispa.org; [EMAIL PROTECTED] Subject: [WISPA] Network Storm To all, I am having a network storm, the first. All activity light switches on the wireless net are flashing like crazy, both at the data center and customer sites, may not mean much, but it has not happened before. There is a huge amount of traffic on the canopy sys. Others have discussed an ICMP storm w/ a (0.0.0.0) address that comes from Linksys Netgear routers. There are about 20 on my net, of 90 users. I am aknow-nothing at this, and really a hardware/RF guy. Not familiar with Ethereal or other SW that monitors the net. What are you all using? Where do I get it? What are your thoughts and advice? Any help or advice you could offer would be greatly appreciated. I'll do whatever you all advise. Ron Wallace Tigernet Phone: 517-547-8410 Mobile: 517-605-4542 [EMAIL PROTECTED] [EMAIL PROTECTED] -- WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/ Internal Virus Database is out-of-date. Checked by AVG Anti-Virus. Version: 7.1.394 / Virus Database: 268.10.1/391 - Release Date: 7/18/2006 -- WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
Re: [WISPA] Network Storm
Tim Kerns wrote: The last time this happened to me 90% of my network was bridged. Now I am 90% routed and have not seen the problem Very true, as long as you're not using Motorola Canopy. We also used routing to break up the broadcast domains. Problem using Motorola Canopy is that an AP Site with up to6APs are bridged within the Motorola site equipment (CMM)and we continued having storms within a site (between multiple offending customer CPE served from the same site) even after adding a router at each site. With non-Motorola APs you can do a better job andblock CPE-CPE traffic within the same AP and independently feed each AP from a site router. Rich - Original Message - From: Tim Kerns To: WISPA General List Sent: Thursday, August 10, 2006 9:52 AM Subject: Re: [WISPA] Network Storm Ron, Are you seeing icmp to other IP's that are unreachable along with the icmp to 0.0.0.0 ? I have seen this in the past and looked like it was coming from a linksys router. I suspected the router was randomly replying to other's IP's, basically causing loops.To isolate I had to disable different AP's to discover which AP it was originating from, then acl each client until I could isolate to a client, long process in between network hangs. The last time this happened to me 90% of my network was bridged. Now I am 90% routed and have not seen the problem Tim - Original Message - From: Ron Wallace To: WISPA General List ; William.L. Edwards Sent: Thursday, August 10, 2006 7:37 AM Subject: Re: [WISPA] Network Storm Thanks Bill. -Original Message-From: William.L. Edwards [mailto:[EMAIL PROTECTED]Sent: Thursday, August 10, 2006 10:26 AMTo: ''WISPA General List'', [EMAIL PROTECTED]Subject: RE: [WISPA] Network Storm It is probably peer to peer traffic. That can take a network down very quickly. You will have to hunt down which user is hammering your network. Probably BitTorrent traffic if I were guessing. W.L. EdwardsCEORNet CommunicationsOffice 765-342-3554Fax 765-349-4880IMPORTANT: Confidentiality Statement:This message is intended only for the use of the Addressee and may containinformation that is PRIVILEGED and CONFIDENTIAL. If you are not theintended recipient, dissemination of this communication is prohibited. Ifyou have received this communication in error, please erase all copies ofthe message and its attachments and notify RNet Communications immediately -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ron WallaceSent: Thursday, August 10, 2006 10:16 AMTo: wireless@wispa.org; [EMAIL PROTECTED]Subject: [WISPA] Network Storm To all, I am having a network storm, the first. All activity light switches on the wireless net are flashing like crazy, both at the data center and customer sites, may not mean much, but it has not happened before. There is a huge amount of traffic on the canopy sys. Others have discussed an ICMP storm w/ a (0.0.0.0) address that comes from Linksys Netgear routers. There are about 20 on my net, of 90 users. I am aknow-nothing at this, and really a hardware/RF guy. Not familiar with Ethereal or other SW that monitors the net. What are you all using? Where do I get it? What are your thoughts and advice? Any help or advice you could offer would be greatly appreciated. I'll do whatever you all advise. Ron Wallace Tigernet Phone: 517-547-8410 Mobile: 517-605-4542 [EMAIL PROTECTED] [EMAIL PROTECTED] -- WISPA Wireless List: wireless@wispa.orgSubscribe/Unsubscribe:http://lists.wispa.org/mailman/listinfo/wirelessArchives: http://lists.wispa.org/pipermail/wireless/ Internal Virus Database is out-of-date.Checked by AVG Anti-Virus.Version: 7.1.394 / Virus Database: 268.10.1/391 - Release Date: 7/18/2006 Internal Virus Database is out-of-date.Checked by AVG Anti-Virus.Version: 7.1.394 / Virus Database: 268.10.1/391 - Release Date: 7/18/2006 -- WISPA Wireless List: wireless@wispa.orgSubscribe/Unsubscribe:http://lists.wispa.org/mailman/listinfo/wirelessArchives: http://lists.wispa.org/pipermail/wireless/ -- WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
