(PM) PPP user causing broadcast storms

Mark Morley (mark@islandnet.com)
Wed, 19 Nov 1997 00:30:07 -0800 (PST)

Today I noticed that when certain users establish a PPP session on one
of our PM3's, I often see a massive flood of UDP broadcast packets. These
packets number anywhere from a few hundred to fifteen thousand, and they
all get sent within a 60-90 second period shortly after the user connects.

A little packet sniffing shows they are netbios name service packets.
They come from the user's IP and are sent to the Class C's broadcast
address. When this occurs, the whole network freezes for a minute or
two.

This does not appear to be a deliberate "attack" by the user. I suspect
that the wrong combination of settings on the user end causes this. Has
anyone else seen this? I have been unable to duplicate the problem so far.

Tomorrow I'll call them all and audit their settings to see if I can
see a pattern, but if you've seen this and know what's causing it please
let me know - thanks.

Mark
-
To unsubscribe, email 'majordomo@livingston.com' with
'unsubscribe portmaster-users' in the body of the message.