Hello
I have flood that it happen about every 2-3min for about 3-4 sec
flood from src.add. 255.255.255.255:(port every day is random)
like hire on this pic.
the flood is not coming from outside its from inside my network and spreading try all my network for about 3-4 sec (its like multicast traffic)
but cant find where is the source of this problem
I put firewall rules,this traffic is dropped
but I rely want to find where its coming from
so any help will be grateful
Tnx.
Have you tried to use the Packet Sniffer under tools? Capture it and get the MAC.
You can also check the ARP list using “/ip arp print” or in winbox under IP->ARP
Tnx for replay
With packed snifter I get src. MAC of interface port of my router for dst. MAC’s I get something like FF:FF:FF… 00:FF:FF..
in Arp list everything is looking normal
from ur experience is it possible this traffic to be generate from some defective switch or some equipment in my network?
its strange because src. port is random but 80% of the traffic dst port is 2048-2049 which is NFS
This days I m looking forward to isolate the problem I will write soon..
Is it possibly being forwarded form a different interface? The router is seeing it as TX, that means that traffic is leaving it’s interface, not coming in. Do you happen to have any of your ports bridged, or on the switch chip? If you are seeing as a specific service, chances are it’s not a dead switch or other hardware. Something is expecting to find a service that is not there.