This article lists the different methods to detect unknown unicast flooding.
The "unknown-unicast-forwarding" knob is used to prevent a traffic storm, it will disable the flooding of unknown unicast packets to all VLAN interfaces by configuring specific VLANs or all VLANs to forward all unknown unicast traffic traversing them to a specific interface. In cases where this knob does not work, alternate measures are required to detect unknown unicast traffic.
To detect unknown unicast flooding on switches, you can use the following steps:
Monitor the traffic levels on the switch and look for abnormal spikes in broadcast, multicast, and unknown unicast traffic.
Use the show ethernet-switching table command to check the forwarding interface for unknown unicast packets. Look for interfaces that have a high number of flooded packets.
For detecting the unknown unicast traffic, the primary measure is having storm control in place. Storm control allows you to set thresholds for the rate of unknown unicast traffic and take actions such as dropping or forwarding the traffic based on those thresholds. Configure storm control on the switch to monitor and control the traffic levels. Set the storm control level to drop or disable interfaces when the traffic exceeds a specified threshold.
Monitor network performance and response times. If there is a sudden degradation in performance or timeouts occur, it could indicate a traffic storm caused by unknown unicast flooding.
Analyze network logs and error messages for any indications of traffic flooding. Look for patterns or anomalies in the logs that could point to excessive traffic.
Use network monitoring tools to track and analyze network traffic. Look for patterns or spikes in unknown unicast traffic that could indicate flooding.
Regularly review and analyze network statistics and performance metrics to identify any unusual behavior or trends.
2024-06-19 : Article Created
2026-09-30 : Externalized