Broadcast packet

Hello everybody,
I have a Windows Server 2008 R2
Enterprise - Enterprise with
TMG 2010,
On the monitor alerts, accused a
blocking connections per minute from a
Determined micro, I analyzed the logs
and saw that there are many blocks of
broadcast
This micro coming port
5355.
The TMG by default blocks the
broadcast, however what makes me puzzled
is the amount of blocking coming this
specific micro.
I analyzed the logs of antivirus
and nothing was detected, the
machine is installed Symantec endopoint.
I would like the opinion of colleagues, I am posting
the following problem:
Cliente IP            Destination ip
Destination Port
192.168.0.130
224.0.0.252               5355           Link-local multicast name resolution      Denied
192.168.0.130
224.0.0.252                 5355           Link-local multicast name resolution      Denied
192.168.0.130
224.0.0.252                 5355           Link-local multicast name resolution      Denied
FWX_E_BROADCAST_PACKET_DROPPED
Denied Connection
SRVTMG 22/01/2013 11:31:30
Log type:
Firewall service
Status:
A broadcast packet was dropped by the Forefront TMG policy.
Rule:
None - see Result Code
Source:
Internal (192.168.0.130:64558)
Destination:
External (224.0.0.252:5355

hello Marc,
I am facing the same issue, with my tmg server as well. I read your post as to "Find the application/service
on the "Micro" which sends Multicast packages and Change the configuration ". but cant figure it out, what to do. I'll be gratefull for your help.
Thanks

Similar Messages

Unable to receive UDP broadcast packets on PPP connection

I am struggling for two days now with no success. I have two modems (do not ask, some special stuff), that uses dial up (PPP) connection. I tried this on windows XP and it works like a charm. I am sending unicast and broadcast UPD packets. If I
repeat that on Windows 7 i can send only unicast data, broadcast packets seems to be lost somewhere. I tried to use Microsoft Network Monitor and I can see that broadcasted packets are being received on my PPP connection. But after that, they are gone. Somewhere
in the kernel. I truly do not understand why. I disabled firewall, antivirus, base filtering engine, tried to log dropped packed in Windows
Filtering Platform, tried clean WIN7 machine and all that with no success.
Here is a sample packet received on interface, but it has newer reach my app:
No. Time Source Destination Protocol Length Info
1 13:20:56.093380000 192.168.1.50 192.168.1.255 UDP 49 Source port: x11 Destination port: x11
Frame 1: 49 bytes on wire (392 bits), 49 bytes captured (392 bits)
Encapsulation type: Ethernet (1)
Arrival Time: May 7, 2014 13:20:56.093380000 Central Europe Daylight Time
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1399461656.093380000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 49 bytes (392 bits)
Capture Length: 49 bytes (392 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:udp:data:vssmonitoring]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: ae:4e:20:00:01:00 (ae:4e:20:00:01:00), Dst: Xerox_00:00:00 (01:00:01:00:00:00)
Destination: Xerox_00:00:00 (01:00:01:00:00:00)
Address: Xerox_00:00:00 (01:00:01:00:00:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
Source: ae:4e:20:00:01:00 (ae:4e:20:00:01:00)
Address: ae:4e:20:00:01:00 (ae:4e:20:00:01:00)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IP (0x0800)
Internet Protocol Version 4, Src: 192.168.1.50 (192.168.1.50), Dst: 192.168.1.255 (192.168.1.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 34
Identification: 0x0032 (50)
Flags: 0x00
0... .... = Reserved bit: Not set
.0.. .... = Don't fragment: Not set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 126
Protocol: UDP (17)
Header checksum: 0xb817 [correct]
[Good: True]
[Bad: False]
Source: 192.168.1.50 (192.168.1.50)
Destination: 192.168.1.255 (192.168.1.255)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: x11 (6001), Dst Port: x11 (6001)
Source port: x11 (6001)
Destination port: x11 (6001)
Length: 14
Checksum: 0xafd1 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Data (6 bytes)
0000 34 34 34 34 34 34 444444
Data: 343434343434
[Length: 6]
VSS-Monitoring ethernet trailer, Source Port: 127
Src Port: 127
I am running out of my ideas, if anyone could help, with any idea, please do. I am not sure if this feature is dropped in win7 or not.

Hi,
From your description, you may gather the network monitor traces to ensure which part lost UDP broadcast packets.
Thank you.
Best regards,
Stevens Song
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Send broadcast packets over VPN

How can I send broadcast packets over vpn , something like bcrelay in poptop linux ?

Hi,
Do you want forward NetBIOS broadcast?
If so, open RRAS console, right clieck VPN server, properties, IPv4, check the option Enable broadcast name resolution.
Hope this helps.

Does the autonomous 1242AG forward broadcast packets?

I have an autonomous Cisco 1242AG AP connected to L2 switches.
Let's say I have 100 wired devices each sending 2 broadcast UDP packets per second.
Obviously these packets will reach the Access Point switch port, but will the AP actually send these packets (200 pps) into the air?
Thanks

Here is the configuration guide for the WLC 4402 and 1130AG follow the configuration guide which will help you
http://www.cisco.com/en/US/docs/wireless/controller/4.2/configuration/guide/c42mfw.html
http://cisco.com/en/US/docs/wireless/access_point/12.4_3g_JA/configuration/guide/ios1243gjaconfigguide.html

How are broadcast IP packets reaching my inet interface?

I was inspecting my iptables log, and noticed a large amount of packets with a broadcast destination ip address (255.255.255.255). Here is a sample log entry:
Mar 9 20:21:10 router kernel: INPUT_OUTSIDE_DROP: IN=eth2 OUT= MAC=ff:ff:ff:ff:ff:ff:00:05:5e:3b:6b:81:08:00 SRC=172.16.4.1 DST=255.255.255.255 LEN=333 TOS=0x00 PREC=0x00 TTL=255 ID=12382 PROTO=UDP SPT=67 DPT=68 LEN=313
These were dropped of course, but how do they get past routers and to my external NIC? Are routers not supposed to block broadcast packets such as these.
My current theory is that these packets are originating at one of my ISP's other clients utilizing the same router as me. That black-hatter is specifying a broadcast MAC address and spoofing his IP hoping to get past a non-stateful firewall with a simple ruleset.
However, I'm curious as to what type of packet crafting can get this packet to route from the Internet all the way to my NIC. If any network guru's can enlighten me as to how these packets are reaching my NIC I'd appreciate it.

that looks like a dhcp server discovery-reply packet. src port 68, dest port 67, to the broadcast ip.
if you are on a cable modem network (docsis), you will see alot of broadcast traffic from your local loop. Mostly from misconfigured devices, or from a computer that was on a private network but then plugged into the router (sending out dhcp discovery packets to try and renew an ip). It could also be someone who plugged in their linksys backwards (lulz) with their modem in bridge mode or something.
Last edited by cactus (2009-03-11 07:05:41)

Broadcast and unknown unicast packets

Hi all,
When the network looping occurs, what the most packets will be generated? Broadcast or unknown unicast packets?
If I want to control the number of unknown unicast packets, which storm control should be configured? Broadcast or unicast storm control?
Thanks a lot,
Nitass

A network loop occurs primarily due to broadcast packets or unicast packets that are sent out of multiple interfaces to the same destination device.
for e.g if you had
PC1
|
Switch 1
| |
Switch 2
|
PC2
and you somehow assume that PC1 knew the exact mac address of pc2 and sent it a unicast frame, even then because STP is not running, it would cause a broadcast storm. This would be a unicast broadcast storm.
Broadcast storm control will only control packets that are designated as broadcast i.e. all 1's. If you suspect the storm is being caused by unicast packets you may have to enable unicast control.
HTH
Please rate posts that help.
Regards
Arvind

ITunes 11 Stops Responding to Bonjour Discovery Multicast Broadcasts, Why? This stops the the Apple TV 3 from being able to start a new stream from the home share and the iPad remote app can no longer see the home share too.

I'm having an issue where my Apple TV 3 and all our iPads periodically seem to loose connectivity to an iTunes home share on a Windows 7 PC. Using a network protocol analyser on the PC I have identified that the point of failure corresponds to the ATV3 sending a bonjour discovery request and getting no reply from iTunes. Why the ATV3 'forgets' where the home share is is possibly another issue but the root cause of the failure is that iTunes, or more specifically the mDNSResponder service, is not responding to the UDP multicast port 5353 broadcast discovery packet sent by the ATV3 or iPad. The mDNSResponder service does start responding again after iTunes is restarted thus making the home share accessible once more, however, this frequent drop out is unacceptable and often happens after only a single TV show has been watched from the home share making the solution unworkable for a family, we simply cannot be restarting iTunes constantly it ruins the user experience completely!
The nature of this failure indicates that the ATV3, the iPads, the host PC and network are all working correctly and the point of failure here is the lack of response to the bonjour discovery protocol with the net result of either a spinning 'connecting to home share' message or the home share just disappearing from the computers section.
If there is a configuration fix for this please let me know as I haven't located a fix! Otherwise this seems very much to be a code flaw in iTunes 11 or the mDNSResponder and I would appreciate some input from Apple! Going on other questions in these forums it would seem the problem is not limited to Windows PCs but also Macs too. NB: This is not a TCP issue, when the ATV3 or iPad knows the IP of the iTunes server all works flawlessly, it just periodically they seem to refresh the list of home shares and at this point they loose the information about the home share they have just been using because of the non-response to the UDP multicast discovery broadcast packet, that is arriving at the host PC and isn't being blocked by the firewall.
Many Thanks!

In my case there was no import from a former mac.
My problem (at least mine) is that no app that offers media sharing works properly. Neither itunes home sharing nor AirVideo nor EyeTV sharing.
So I'm pretty sure that this is network issue.
Adding another user on my mac and sharing a new library works not also. But sharing from another laptop in my WiFi works. So this has to be a network issue on my mac, not only my user, but an issue of the whole system.
But I'm not willing to reinstall MacOS X for that if I don't have to.

Data socket and broadcast address

it's posible to use broadcast or multicast address to get resources in a local net?, in order not to specify the exact ip address where the resource is located.
many thanks in advance
Mikel Eguiraun

Hi,
you can broadcast using broadcast IP addresses (see link):
http://www.freesoft.org/CIE/RFC/922/10.htm
A broadcast is a data packet that is destined for multiple hosts. Broadcasts can occur at the data link layer and the network layer. Data-link broadcasts are sent to all hosts attached to a particular physical network. Network layer broadcasts are sent to all hosts attached to a particular logical network. The Transmission Control Protocol/Internet Protocol (TCP/IP) supports the following types of broadcast packets:
•All ones—By setting the broadcast address to all ones (255.255.255.255), all hosts on the network receive the broadcast.
•Network—By setting the broadcast address to a specific network number in the network portion of the IP address and setting all ones in the host portion of the broadcast address, all hosts on the specified network receive the broadcast. For example, when a broadcast packet is sent with the broadcast address of 131.108.255.255, all hosts on network number 131.108 receive the broadcast.
•Subnet—By setting the broadcast address to a specific network number and a specific subnet number, all hosts on the specified subnet receive the broadcast. For example, when a broadcast packet is set with the broadcast address of 131.108.4.255, all hosts on subnet 4 of network 131.108 receive the broadcast.
Also on the next link you can find multicast addresses explanation:
http://www.cisco.com/univercd/cc/td/doc/cisintwk/ito_doc/ipmulti.htm#wp1020564
You can find several examples of UDP Multicast and broadcast on the Examples of labview (go to Help
-> Find examples -> Search and then you write UDP).
Normally broadcasting and multicasting use that protocol (UDP) due to the fact it do not need an ACK in the communication. If you plan to use TCP then you will need a connection for each computer (IP). There are also examples with labview of TCP with multiple connections.
Hope that info helps u,
Regards,
Jaime Cabrera
NI Applications Engineering Spain

Is it possible for two servers to receive broadcasts on the same port?

I'm trying to run multiple instances of a class that creates a UDP socket that receives broadcast packets on a specific port:
socket = new DatagramSocket(port);
The second and succeeding instances get a BindException because the address is already in use. Is there a way to have multiple servers on a specific port?

It works. So now instead of just new DatagramSocket(port), my code now reads:
socket = new DatagramSocket(null);
socket.setReuseAddress(true);
SocketAddress sockAddr = new InetSocketAddress(port);
socket.bind(sockAddr);
Thanks.

Wireless packet flow explanation

Hi My requirement is very simple , I will appreciate if someone can explain me the following concept as per the diagram mentioned below
I have 2 APs AP1 and AP2, both connect to switch on port f0/1 and f0/2 , the switch f0/3 inturn connects to a router on f0/0 , router's interface f0/1 connects to another switch which is wired network with ip add 192.168.2.0/24 .
1. APs broadcast 3 ssid (management , guest , cisco) respectively , how would the data flow happen for user connected to SSID cisco when pings another user connected to SSID guest , and how would data flow happen when user in SSID cisco ping a user 192.168.1.100 some user is wired network.
you can assume both the APs are autonomous and there is no controller.
I am looking for explanation in terms of frame tagging and packet encapsulation and depacsulation at various stages.
you can assume the IP nd vlan number on wireless network as you like.
2.if you are not tired yet then one mroe question with same topology , but this time the APs are lightweight and the controller is in a different subnet 192.168.1.0 , assume that the AP is already registered with controller , now how would the same above communication happen ,
I am looking for explanation in terms of frame tagging and packet encapsulation and depacsulation at various stages.
you can assume the IP and vlan number on wireless network as you like.
If you can refer me some doc its fine with me , I already went through many documents and nuggets , I do have a clear picture.
Thank you

1.
client to AP ===> 802.11 frame.
AP to client ===> 802.11 frame. At AP, received wired side ethernet frame removes the ethernet header with tag and encapsulates the IP packet using 802.11 header with right Bssid for that vlan.
AP ethernet to switch interface ===> Tag/UnTag Ethernet frame. At AP, received 802.11 frames removes the 802.11 mac header, the inner packet will be used to encapsulate using ethernet frame with Tag based on received Bssid.
ARP request - Broadcast packet sent by wireless client to AP as unicast. Once it decapsulates the 802.11 header, the inner IP packet hits the wire on that broadcast domain to reach upstream wired switch and wireless on same AP.
2.
AP to WLC ===> capwap/lwapp. 802.11 packets are encapsulated on L3 IP-UDP.
WLC to AP ===> capwap/lwapp.
All the client (802.11) packets are encapsulated in a LWAPP packet by the LAP and sent to the WLC. WLC descapsulates the LWAPP packet and acts based on the destination IP address in the 802.11 packet. If the destination is one of the wireless clients associated to the WLC, it encapsulates the packet again with the LWAPP and sends it to the LAP of the client, where it is decapsulated and sent to the wireless client. If the destination is on the wired side of the network, it removes the 802.11 header, adds the Ethernet header, and forwards the packet to the connected switch, from where it is sent to the wired client. When a packet comes from the wired side, WLC removes the Ethernet header, adds the 802.11 header, encapsulates it with LWAPP, and sends it to the LAP, where it is decapsulated, and the 802.11 packet is delivered to the wireless client
check:-
https://supportforums.cisco.com/message/3489064#3489064
https://supportforums.cisco.com/message/3717713#3717713

Packet drops on 2960 with port-security enabled

Hello,
We are using the following port-security configuration on user access ports on Cisco 2960 switches, in order to protect the infrastructure to prevent MAC flooding attacks:
switchport port-security maximum 10 switchport port-security switchport port-security aging time 1 switchport port-security violation restrict switchport port-security aging type inactivity
There is a problem with the more "quiet" hosts, especially in technology - every time the MAC address ages out, the first packets (an ARP request usually) sent by the host is dropped by the switch. There is no violation logged, the switch should be OK to forward the packets but doesn't:
Port Security : EnabledPort Status : Secure-upViolation Mode : RestrictAging Time : 1 minsAging Type : InactivitySecureStatic Address Aging : DisabledMaximum MAC Addresses : 10Total MAC Addresses : 0Configured MAC Addresses : 0Sticky MAC Addresses : 0Last Source Address:Vlan : 0011.aabb.ccdd:11Security Violation Count : 0
When port-security is turned off, all packets are forwarded without trouble. This is happening on both WS-C2960-24TT-L and WS-C2960-8TC-L, with IOS 12.2(35)SE1 and 12.2(50)SE5, respectively. I didn't check other models yet.
I have found similar reports and bugs for the 2950 and 3750:
https://supportforums.cisco.com/thread/163910
https://supportforums.cisco.com/message/89560
https://tools.cisco.com/bugsearch/bug/CSCeg63177
https://tools.cisco.com/bugsearch/bug/CSCec21652
Is there anything we can do to fix this?
Is there an access switch that would not suffer from this problem? (Like 2960-S maybe?)
Thank you.

Hi Alioune,
This is expected behaviour on the Nexus 1000v Ethernet interfaces when the uplinks are configured with MAC pinning.
When using MAC pinning there's no special configuration of the ports on the upstream physical switches and so any broadcast packets are sent by the upstream switches on all uplinks towards the Nexus 1000v switch.
On each VEM of the Nexus there's one uplink interface that is chosen as the Designated Receiver for broadcast traffic, and the function of the DR is to forward received broadcast traffic to VMs within the VLAN. The broadcast traffic received on any other uplinks of the VEM i.e., those that are not the acting as DR, drop the received broadcast traffic on ingress to the VEM.
The drops you're seeing on the uplink interfaces are almost certainly the broadcast traffic being received on one or more non DR uplinks.
Regards

Show interface - received broadcast - counter - Vlan - L2 mcast

HI All,
I have a situation where the Show interface on 7609 displays broadcast counters. I did capture wireshark but did not see any broadcast. Wireshark broadcast for 1 minute shows 20 broadcast packets where as Vlan interface shows increase at rate of 1000 per minute.
L2 Switched: ucast: 8529 pkt, 896149 bytes - mcast: 35427 pkt, 2338134 bytes
L3 in Switched: ucast: 0 pkt, 0 bytes - mcast: 0 pkt, 0 bytes mcast
L3 out Switched: ucast: 0 pkt, 0 bytes mcast: 0 pkt, 0 bytes
40978 packets input, 2996897 bytes, 0 no buffer
Received 35607 broadcasts (0 IP multicasts)
The doubt I have is that I am running HSRP on LAN with 5 groups and 300ms hello. This makes around 1000 hello packets per second. The L2 multicast counter also increases at almost same rate of 1000 packets per second . The received broadcast and L2 mcast counters are almost same.
Is it likely that the received broadcast also includes the HSRP hello packets destined for 224.0.0.2? but it does shows(0 IP multicast).
Can someone please confirm that the received broadcast counter includes multicast HSRP packets or is it just a coincidence. But again on wireshark I dont see 1000 broadcast packets only HSRP packets in addition to unicast traffic.
Any help or Cisco link that can prove this will also help.
Thanks
M

Found the answer.
Anatomy of RX packet counters on a Cisco Nexus 5548:
Nexus5548# show int eth1/29
RX
6387682660 unicast packets 1495485 multicast packets 164 broadcast packets
6389178309 input packets 589693485138 bytes
5146969 jumbo packets 0 storm suppression bytes
* "input" = unicast + multicast + broadcast (all non-jumbo)
* "jumbo" = frames sized 1519 bytes to the MTU bytes defined on the interface
* "jumbo" frames are counted separately from non-jumbo ("input")
* (unicast, multicast and broadcast "jumbo" frames appear to be rolled into the
one "jumbo" counter)
This can be seen another way with the 'count detail' command, correlated to "show int" output:
Nexus5548# show int eth1/29 count detailed
Ethernet1/29
Rx Packets: 6389178309 <-- input
Rx Unicast Packets: 6387682660 <-- unicast
Rx Multicast Packets: 1495485 <-- multicast
Rx Broadcast Packets: 164 <-- broadcast
Rx Jumbo Packets: 5146969 <-- jumbo
Rx Bytes: 589693485138
Rx Packets from 0 to 64 bytes: 1059418 <-- non-jumbo start
Rx Packets from 65 to 127 bytes: 6072007478 +
Rx Packets from 128 to 255 bytes: 11055520 +
Rx Packets from 256 to 511 bytes: 287107435 +
Rx Packets from 512 to 1023 bytes: 12801466 +
Rx Packets from 1024 to 1518 bytes: 23 <-- non-jumbo end
Rx Trunk Packets: 6387682823 <-- unicast + broadcast
fyi.

Directed broadcast and unicast

Hi all ,
below is an excerpt from the link http://www.cisco.com/web/techdoc/dc/reference/cli/nxos/commands/l3/ip_directed-broadcast.html
A device that is not directly connected to its destination subnet forwards an IP directed broadcast in the same way it would forward unicast IP packets destined to a host on that subnet. When a directed broadcast packet reaches a device that is directly connected to its destination subnet, that packet is broadcast on the destination subnet. The destination address in the IP header of the packet is rewritten to the configured IP broadcast address for the subnet, and the packet is sent as a link-layer broadcast.
here is my question
When server on serverfarm switch sending a wol packet ( ip directed broadcast 10.0.7.255 ), it would forward like a unicast packet .
The unicast packet will be routed through the core to the distribution . So as i understand i don't need to do any configuration changes on the core .
The changes required only on distribution and serverfarm .
Please correct me i am wrong .
My configurations are below
Serverfarm
Interface vlan 10
Ip add 192.168.80.2 255.255.255.0
host
Distribution
Interface vlan 100
Ip add 10.0.7.2 255.255.255.0
Serverfarm switch
interface vlan 10
ip helper-address 10.0.7.255
Distribution switch
access-list 102 permit udp host 192.168.80.10 any eq 7
ip forward-protocol udp 7
interface vlan 100
ip directed broadcast 102

Most tools to generate WoL Magic Packets send them as UDP datagrams and set the destination IP to the limited broadcast address 255.255.255.255, thus those Magic Packets are never routed (Scope = local subnet).
Thats why you need in this case the ip-helper command, which converts (local) UDP broadcasts of serveral well-known protocols (DHCP, TFTP, DNS, NetBIOS, TACACS) into unicasts and then forwards them to the helper address.
Since the portnumbers typically used by WoL tools (7, 9) are different from those used by the well-known protocols, you'd also need the 'ip forward-protocol udp <number>' command to make it work.
If I understand you correctly, your WoL tool allows you to set the destination IP to a directed broadcast IP. In this case you don't need any additional configuration because directed broadcast IPs are routable.
HTH
Rolf

Getting Broadcast traffic from one 3745 to another

The topology is simple. Three 3550 switches as the backbone tied together using spanning-tree layer 2 wire speed switching. Very simple stuff there. Introduce 3745 access routers, one attached to each 3550, each loaded with 16port ESW, 1 GigE GBic card, and a 8A/S card.
The problem is we have systems that blow out broadcast traffic that needs to traverse accross all 16-ESWs. We have tried all manor of things but we can not get broadcast traffic to traverse the 1GE port. We can see packets hitting the interface but they are simply getting dropped on the floor.
I can go into more detail if needed but we think we're missing a painfully simple detail. Perhaps something to do with L3 and L2? Perhaps something to do with bridge groups or vlans or helper protocols?
Any wisdom to help us out would be greatly appreciated!

Dwayne
As you probably already know, the helper-address is configured on the interface that receives the broadcast to be forwarded. So if the broadcast source is in a 16ESW then I would expect the helper address to be configured on whatever interface (probably virtual) repersents the layer 3 interface for those layer 2 ports.
The function of helper address is that it takes a broadcast packet and forwards to some destination address. The general assumption is that the destination address will be unicast. The destination address can be a subnet broadcast (directed broadcast) and I assume that this is what you are trying to do. Is this correct? If so then be sure that you have ip directed-broadcast enabled on the interface where the destination subnet is located.
Another potential issue is identification of broadcast packets to be forwarded. Helper address is not intended to forward ALL broadcasts. There is a group of protocols that are enabled by default (DHCP, TFTP, etc). If the broadcast packets that you want to forward are not one of these default protocols then you need to use the ip forward-protocol udp command which would be configured on the interface receiving the initial broadcast (the same interface as the helper-address).
You probably have these already. But I can not find a good description of what is configured where and thought that a review of these principles might be helpful.
It probably would be quite helpful to post configs of at least one 3745 and also its associated 3550. If you do not want to post these on the forum please feel free to EMail them to me. My EMail address is available from my forum profile.
HTH
Rick

Broadcasts between multiple routers using IP HELPER

Hello everyone,
I newly CCNA qualified and i need some help-clarification regarding ip helper command.
A few words about the setup of the network:
The place were i work has multiple routers connected to a central router. For example I have router A and Router B. I need a PCs on the LAN segment of router A to be able to broadcast packets to a server (Domain Controller) located on the LAN of router B. I also want broadcasts from the server to travel freely to the LAN of the PC on router A. These two routers are connected with 2Mbps FR.
My configurations work, but i am not sure if i configured unnecessary commands. Can you please give me a sample configuration stating the interfaces were i need to configure IP HELPER-ADDRESS , and if i need the IP DIRECTED-BROADCAST command at all.
Also i have used IP FORWARD-PROTOCOL UDP command.
Thank you very much,
George

George,
OK. You want broadcasts from PCs on LAN A to go to the servers on LAN B. I shall presume that you do not know how many PCs are on LAN B; you just want the broadcast to be seen by all of them. So, suppose the address of LAN B is 192.168.30.0/24, you should go to the interface of LAN A, and configure ip helper-address 192.168.30.255. This will forward brodcasts from LAN A to LAN B. By default, when they arrive at LAN B, the router there would try and send them to a host 192.168.30.255 - but this is not what we want. So on LAN B, you will need the command ip directed-broadcast. This will recognise the packet 192.168.30.255 as a directed broadcast, and it will make sure it gets sent as a MAC broadcast, rather than a host unicast.
In the other direction, just for illustration, I shall assume that you are only interested in passing the PC broadcasts to the specific server in LAN A, let us say 192.168.20.45. In this case, go to the interface of LAN B, and configure ip helper-address 192.168.20.45. This will see the PC broadcasts, and send them to the server on LAN A. In this case, it is not necessary to configure ip directed-broadcast on LAN A, because, it is enough to send the packets to just that server.
Of course, if you want the PC broadcasts to go to all servers in LAN A, you have two options: either you send them to 192.168.20.255 and enable directed broadcasts on LAN A, or you make a list of servers, and have an ip helper-address on LAN B for each one.
As for ip forward-protocol, it may not be necessary. There is a list of protocols that the ip helper-address command forwards by default. You only need the ip forward-protocol command if you want to deviate from the list. See doc for details:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fipras_r/1rfipadr.htm#wp1018606 http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fipras_r/1rfipadr.htm#wp1018318
I hope this clarifies things for you.
Kevin Dorrell
Luxembourg

Broadcast packet

Similar Messages

Maybe you are looking for