Has anyone come up with a way to protect a single network port from Loops/Storms?

Example:
AP ----wireless------ Radio CPE ----cabled---- Consumer Grade Router

AP is a PPC333, XR5, ROS3.2, WDS Dynamic Bridging of connected radios to Lan
CPE is an RB133, R52, ROS2.9.51, wLan bridged to Lan
Router can be anything, Linksys etc, Running PPPOE.

If you now replace the Router with an unmanaged switch and loop two of the switches network ports to get a storm going (you might need to kick start the storm with a windows pc by connecting it to the looped switch for a few seconds), you will overwhelm the network and cause a DOS to all the other Radio CPEs on the AP

From my experience, STP/RSTP is no good for protecting a single port, two seperate interfaces in an STP enabled bridge need to be looped for it to kick in and block one of the ports.

I have heard of something new by Nortel called SLPP - but this is not supported in MT/yet

Any Ideas?

--Ged

I'm having same problem. Customer's stupid switch time to time loop my whole network.

Have anyone some idea howto detect it or better block this one radio station?



thanks

Use only clients with NAT enabled, so broadcast domain for network loops will only be behind NAT-Router, causing only this one user trouble. I would not want (l)users to have access to my backbone bridged. You could use routed clients if you prefer, but that's a bit more work to configure properly, broadcast domain will still be only subnet of the user himself, not the whole network.

Set CPE to PPPOE - client, your users could then use their own routers behind without PPPOE if they like to or just could add a switch

Sincerly

Schnulch

Found a solution I can script. It would be great if MT could refine it to just be a "Loop Detection" checkbox on an interface page

This is monitored on a per interface basis, ether1 in this case:

1. Add a bridge firewall rule that detects packets in-interface=ether1 where the source MAC address is the same as ether1.
2. Ping a bogus address, using the interface=ether1 parameter (you do not need to add an IP to the ether1 interface) This forces a packet from the interface you are monitoring out onto the network you want to test.
3. Script running in the background that checks the value of the Firewall packet counter above every 5 seconds.
4. If counter does not equal 0 then you have a loop.
5. A second Bridge firewall rule then gets enabled which drops all traffic on the bridge to protect your bridged network/s.
6. Keep checking the counter and when it stops counting up, disable the drop rule and let the network operate correctly again.

Someone figured out how to solve this problem?

Thanks