Question

Two hundred workstations and four servers on a single LAN are connected by a number of switches. You're seeing an excessive number of broadcast packets throughout the LAN and want to decrease the effect this broadcast traffic has on your network. What steps must you take to achieve this goal?

Answer 1

Answer:-

First, be sure this is really a problem that needs to be fixed. Broadcast packets are typically small, with low impact. I once saw a network I didn't control, where I thought it had too many broadcasts. After I calculated the percentage of bandwidth, I had to admit the traffic was benign. So if it ain’t broke…

You could split the network with a layer 3 switch or router or two; those don’t pass broadcasts. But the hassle, cost and performance overhead probably aren’t worth it.

Otherwise, you're going to have to identify the reason for the broadcasts. Presumably you discovered them with something like Wireshark. Use it to see what kind they are. E.g., are they ARPs? For what IP? Maybe they are trying to reach a host they shouldn’t be. Why?

Then you can potentially take appropriate action and correct the source.

But don't be distracted by the number of devices on the LAN. Just because it’s approaching the limit for a class C (/24) subnet is irrelevant. And network switches always forward all broadcasts to all ports, by design; it may make them look like a lot, but unless you are watching from a switch monitor port, you won’t even see most of the unicast traffic, which only affect a couple of ports.

To decrease the effect:

• Split the LAN up into two or more VLAN’s, with the servers on whichever one[s] they need to be on.

To decrease broadcast quantity:

• Increase the time between broadcasts by changing settings.
• Disable protocols and services where they are not needed but are active and doing broadcasts. Maybe not every device that is doing some broadcasts needs to be doing so.

Use Wireshark or something similar to capture, count, and identify the broadcasts. Determine that they are in fact excessive and constitute more than a few percent of capacity, not of total traffic. The quantity may be large, but the impact minimal. Learn how to change configuration settings to increase the time between them.