Brian:

The best way to catch unicast flooding is to span the upstream trunk and look unicast packets that should not be on that segment. We often compare the mac's of the source to the traffic and see if these are being flooded down the segment. If you would like more help email me off line.

==DMT>

%SIG%

Douglas M. Todd, Jr. Network Engineering (MGH/CNY/NSMC/MCLEAN) Partners Health Care Building 149 13th Street Location: 149-10-10056E Charlestown, MA 02129-2000 (MGH) (T): 617.726.1403 (F): 617.724.9871 Security: Verisign S/N: 7b1bb86860eb26a53b57c8acb8e9fc4f pgp: search keyserver for: dtodd at partners.org

--------------------------------------------------------------------------------

---- The information transmitted in this email is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged information. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended

recipient is prohibited. If you received this email in error, please contact the sender and delete the material from any computer.

old>>-----Original Message----- old>>From: cisco-nsp-bounces at puck.nether.net old>>[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of old>>Brian Turnbow old>>Sent: Tuesday, January 18, 2005 05:37 old>>To: cisco-nsp at puck.nether.net old>>Subject: [c-nsp] Identify unicast flood traffic old>> old>> old>>Hello Everyone, old>>I am trying to find a way to detect unicast flood mac old>>addresses on cat 3550 and 3750, does anyone have any ideas old>>besides a sniffer ? old>>Something similar to the sh mac-address-table old>>unicast-flood command on old>>6500 old>>Thanks old>>Brian old>>_______________________________________________ old>>cisco-nsp mailing list cisco-nsp at puck.nether.net old>>https://puck.nether.net/mailman/listinfo/cisco-nsp old>>archive at http://puck.nether.net/pipermail/cisco-nsp/ old>>