network flooding

This is what I do on my LAN (which has no managed switches) ... works to a limited degree. If the flooding is cause by a defective NIC (will be generating a lot of "noise" continuously), watch the main switch during OFF hours and you can tell from the blinking lights, which port is handling a lot of traffic. You may have to track multiple switches/hubs if they are linked. If a couple of PCs are intentionally causing a lot of traffic, you can still do the same but it will be more difficult to isolate the culprit(s). If you can afford it, you can purchase managed switches that allows you to monitor the various ports real time. Out ISP allows us to view Snappy Graphs (daily, weekly, monthly) that shows our internet traffic over a period of time. It does not help to isolate offending PCs but helps to point out anomalies in normal traffic. I have also resorted to re-booting the ADSL modem and router and that has also helped on occasion. If anyone has better ideas ... I'm all ears ... I could use them. Good Luck

I would reccomend looking at a network monitoring application that can see all layers of the network.

Sniffers work well for situations like this because they can report valuable information relating to node activity, type of activity, (broadcast,unicast,etc.) and protocol information.

I have had a number of issues like this myself and have used ethereal and etherpeek (which is expensive) to troubleshoot and remedy some tough situations. When the offending node is isolated you can block the MAC address or if you are using smarter devices, you can set traffic thresholds for certain types of traffic and automatically block "nasty nodes" from flooding your network with traffic.

Best regards,

P