Multicast Traffic storm flooding network

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Mark Heimonen (marhei_at_munroept.com)
Date: 05/04/04 

Date: Tue, 4 May 2004 08:47:41 -0400

We moved to a new location over the weekend, and have a problem that seems
to occur after the network is up for about two hours. We have a small
network - a couple Windows 2000 servers, with Windows 98, 2000, and XP
clients. All computers, along with a T1 line, are connected to an HP
Procurve Switch. After starting up the network, everything seems to work
fine for a few hours. Suddenly, the network appears unresponsive.

Our domain controller appears to be the culprit. This server has two NICs,
which are both connected to the switch. Using the web-based monitor
available on the switch, I discovered that one of the NICs, along with the
T1 line are both at 100% utilization. I installed the network monitor
component on the server, and discovered that the source of the problem
appears to be thousands of multicast frames per second being sent to the T1
line. The multicast frames are of the form, with seemingly random IP
Addresses listed:

Dest MAC Protocol Desc

000BFD0F0B00 SSP Unknown Security Support Provider

It doesn't appear that any Multicast traffic is used on the network until
this situation occurs.

Questions:

What is multlicast traffic used for? Is there any way I can disable
Multicast traffic on the server's NIC?

What is SSP?

What steps can I take to debug this problem? (I have tried turning
Automatic Broadcast Control and Multicast Filtering on the switch, to no
avail. I also tried enabling Spanning-Tree Protocol...Is having two network
cards on the server connected to the same switch a potential source of
problems?)

I have also read that we could have a half/full duplex problem...Currently,
I have all ports on the switch set to auto. Should I manually set the ports
for the server and the T1 line? If so, what should a T1 line usually be set
to?

Relevant Pages

  • Re: RDP Connections - Freeze or Reconnect
    ... I immediately swapped the connector and cable out and plugged the cable coming out of the switch into the spare 100mb NIC adapter but still using the connector and extra cable. ... The connection of the 100mb LAN from then on appeared much more stable. ... If I logon and test the RDP connection with a dialup modem through RRAS (Terminal server is also a RAS Server), would you expect it to misbehave if it was I switch problem? ... You mentioned seeing a red X on the server's network connection in an earlier post. ...
    (microsoft.public.windows.terminal_services)
  • Re: Backup to USB works but to NAS fails
    ... There is a 30' stretch from the server to a hub (which doesn't have ... Then 3' to the NAS drive. ... Can you reduce things down to one decent switch. ... Poor network throughput, is most commonly, use of cheap 25$ ...
    (microsoft.public.windows.server.sbs)
  • Re: Backup to USB works but to NAS fails
    ... Then 3' to the NAS drive. ... If we put another network card in the server we ... Can you reduce things down to one decent switch. ... Poor network throughput, is most commonly, use of cheap 25$ switches. ...
    (microsoft.public.windows.server.sbs)
  • Multicast Traffic storm flooding network
    ... Correct me if I am wrong - but that SSP traffic is UPNP ... >to occur after the network is up for about two hours. ... >which are both connected to the switch. ... >appears to be thousands of multicast frames per second ...
    (microsoft.public.windows.server.networking)