How to detect a Spanning tree loop !

I have come across this situation many times in my career, and below are the common symptoms i have managed to jot down, hope it helps.

  1. Loads on all links will increase , not just on the links which has a loop but all the links which are in the switch domain, this is because some of the frames are flooded on all links. naturally when a spanning tree failure is limited to vlan, only links on that vlan will get affected, the rest of the vlans will stay unaffected.
     
  1. If spanning-tree failure has caused more than one bridging loop, it will increase traffic exponentially,  this is because not only frames will cycle in an endless loop but because of having multiple loops, frames will start getting duplicated.
     
  1. When Control pane traffic such as HSRP, OSPF, EIGRP start entering the loop, the devices which are running these protocol will soon get overloaded, there CPU will increase exponentially , in some cases upto 100 % processing the load of control panel traffic. In many cases the earliest indication of a broadcast storm in progress is routers and layer 3 switches report control pane failures e.g. continual HSRP state changes or routers continually running at 100 % CPU.
     
  2. Switches will experience frequent mac address table changes, this is because of the frames looping in both direction, looping in both direction cause the switch to see a frame with a source address coming through one port and then shortly later the same frame coming though a different port.
  1. Because of the combination of high load on all links as well as high CPU at the same time, this causes the switches and routers to go into a state where they are unreachable, making it nearly impossible to troubleshoot which the broadcast storm is in progress.

  1. Load on all links will increate, not only the loop links but all links, limited by vlan
  2. Multiple loops will cause exponential traffic, frames will start getting duplicated
  1. Control pane traffic will increase making CPU high, indication of broadcast storm is to look for 100 cpu and continual hsrp state changes.

  1. MAC address table continually changing , because frames looping in both direction, switch will see frames with a source address coming from one port and than moments later the same frame coming though a different port.
  2. Both high load and high cpu renders the switch / routers un-useable.

No comments:

Post a Comment