Loop - broadcast storm in network

Question

Good day to you all, i'm with some problem and i can't seem to find the right solution.
at our company we have arround 300 2960 switches, also in some areas of the factory they are using 3com hubs or other hub devices.
i am trying to take them all out, but the factory is to big and there are more then 100 on places i dont know.
My problem is that many times we have a broadcast storm or loop in the network.
users just put in 2 cables in a hub, or the cisco phone both cables in the hub.
the hub is connected to a 2960 switch.
My port configuration is:
interface FastEthernet0/3
switchport access vlan 27
switchport mode access
switchport voice vlan 244
spanning-tree portfast
spanning-tree bpduguard enable
end
the STP settings global are:
spanning-tree mode pvst
spanning-tree loopguard default
spanning-tree portfast bpduguard default
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
in my opinion the port that have the 3com connected should go in to err-disable when a loop is created because it receive BPDU packets.
unfortuinatly this does not happens and my whole network goes down.
the logging in the switch only indentify that there is mac flapping.
Mar  1 07:28:02: %SW_MATM-4-MACFLAP_NOTIF: Host 0026.18d6.e3d6 in vlan 27 is flapping between port Fa0/2 and port Gi0/1
Mar  1 07:28:18: %SW_MATM-4-MACFLAP_NOTIF: Host e05f.b9e5.acba in vlan 27 is flapping between port Fa0/45 and port Gi0/1
Mar  1 07:28:38: %SW_MATM-4-MACFLAP_NOTIF: Host e05f.b9e5.acba in vlan 27 is flapping between port Fa0/45 and port Gi0/1
Mar  1 07:28:42: %SW_MATM-4-MACFLAP_NOTIF: Host 0026.18d6.e3d6 in vlan 27 is flapping between port Fa0/2 and port Gi0/1
Mar  1 07:28:50: %SW_MATM-4-MACFLAP_NOTIF: Host 0026.18d6.e3d6 in vlan 27 is flapping between port Fa0/2 and port Gi0/1
Mar  1 07:28:50: %SW_MATM-4-MACFLAP_NOTIF: Host e05f.b9e5.acba in vlan 27 is flapping between port Fa0/45 and port Gi0/1
Mar  1 07:29:03: %SW_MATM-4-MACFLAP_NOTIF: Host 0026.18d6.e3d6 in vlan 27 is flapping between port Fa0/2 and port Gi0/1
Mar  1 07:29:06: %SW_MATM-4-MACFLAP_NOTIF: Host e05f.b9e5.acba in vlan 27 is flapping between port Fa0/45 and port Gi0/1
Mar  1 07:29:16: %SW_MATM-4-MACFLAP_NOTIF: Host 0026.18d6.e3d6 in vlan 27 is flapping between port Fa0/2 and port Gi0/1
Mar  1 07:29:18: %SW_MATM-4-MACFLAP_NOTIF: Host e05f.b9e5.acba in vlan 27 is flapping between port Fa0/45 and port Gi0/1
Does someone have an idea to prefent this from happening ??
Thanks a lot!

Answer 1

Hello
My question is should i only set on the interface "storm-control broadcast level ??"
or do i also need to set multicast and unicast ? - All depends on what traffic you have traversing your links you need to be sure you dont set the levels to low has to prohibit legitimate IGP/broadcast/mulitcast/unicast traffic this includes any bespoke application traffic that utilzies any of the above
and why is the 3 to 5 %, so it will drop the storm when reach 95 % on interface ? - 5% of an 100mb link would be reached at 5 mb utilization of whatever traffic you define, the higher rate the less effective stom controll is.
To protect against layer 1 devices such are hubs and say access ports with attached switches(managed/unmanaged) you can also apply port-security running along side your current stp bpduguard.
switchport nonegotiate ( disables DTP)
switchport port-security ( enables port security)
switchport port-security aging type inactivity ( ageing of mac- address)
switchport port-security aging time xx  ( mins the mac address will age out)
Switchport port-security violation restrict| shutdown ( violation action of port-security)
Switchport port-security max xx ( number of mac- address allowed on port)
res
Paul
Please don't forget to rate any posts that have been helpful.
Thanks.