Professor Messer 5.5 | Common Network Issues

Half-duplex Ethernet

Though rare today, can still be found with legacy devices connected to hubs.

If two devices transmit simultaneously, a collision occurs, corrupting the data. Both devices detect the collision, pause for a random time, and then attempt to retransmit the data.

Collisions

On a half-duplex link are expected, high network utilization leads to excess.

In modern full-duplex Ethernet connections, collisions should not occur. If they do, it may indicate issues such as duplex mismatches, incorrect interface configurations, or hardware problems like a faulty NIC or driver.

#show interface f0/1

If you were to look at a Cisco switch and do this command for a particular interface, you can see:

The number of runts, giants, input errors, CRCs, collisions, or late collisions, which might give you some insight into how well this interface is performing.

Broadcast storms

Occur when excessive broadcasts overwhelm a network.

IPv4 requires broadcasts for certain protocols, but too many can degrade performance since every device in the broadcast domain (within the same VLAN) must process each broadcast.

Troubleshooting broadcast storms

Start by using packet capture to identify the source and frequency of broadcasts. Research the process generating the broadcasts to determine if there are alternative solutions

Splitting a large subnet into smaller routed subnets, which isolates broadcast traffic and improves network performance.

Duplicate MAC addresses

Though rare, can occur due to locally administered addresses, manufacturing errors, or even on-path attacks like man-in-the-middle. This can cause intermittent connectivity as devices contend over the same MAC address in ARP requests.

To troubleshoot, use packet captures to observe ARP contention, where the MAC address keeps changing for a single IP. You can ping a device, look at your ARP cache, and see what MAC address is associated with that particular IP address.

Duplicate IP address

Often result from static address assignments or overlapping DHCP servers, including rogue DHCP servers. This can lead to intermittent connectivity as devices "fight" for the same IP.

Many modern operating systems automatically detect duplicate IPs at startup and disable the network interface to avoid conflicts.

Troubleshooting duplicate IP addresses

Start by verifying the uniqueness of each device’s IP configuration. Before assigning a static IP, ping the address to ensure it's not already in use.

If conflicts persist, ping the suspected IP address and check the ARP table to identify the corresponding MAC address. Use the switch’s MAC table to trace the device.

Capture the DHCP process to see if multiple DHCP servers are responding.

Multicast flooding

Used for one-to-many traffic flows; the destination IP address for multicast is a multicast IP address. It’s not an actual device on the network. So your switch doesn’t know where to send multicast traffic. So by default, it will send traffic to every switch port on that switch.

This results in all devices receiving the multicast traffic, even those not involved in the communication. The excess traffic consumes bandwidth, switch processing time, and device resources, leading to inefficiencies in the network.

IGMP snooping

Allows switches to more efficiently manage multicast traffic by monitoring Internet Group Management Protocol (IGMP) messages between hosts and routers.

This enables the switch to forward multicast traffic only to the devices that have joined the multicast group, preventing multicast flooding. To implement this, IGMP snooping must be enabled on the switch.

Asymmetric routes

Occur when outbound and inbound traffic between devices follow different network paths, often due to network redundancies.

While intentional asymmetric routing is usually fine, unintentional routes can cause issues with firewalls and stateful devices, which may not recognize the flow and drop the traffic.

Traceroute can help identify these routes.

If asymmetric routing is intentional, firewalls and state-based devices must be configured to accommodate the routing pattern.

Switching loops

When switches continuously forward traffic between themselves based on destination MAC addresses, creating a loop that can flood the network.

This is a significant concern for network administrators. Spanning Tree Protocol (STP) is often configured to prevent such loops.

Unlike IP addresses, which have a Time to Live (TTL) to detect loops, MAC addresses lack this mechanism; if a loop is created, the traffic will circulate endlessly until the loop is eliminated from the network.

Switching loop example:

In a network with two switches connected by a single link, data can flow between devices without issue. However, if an additional link is inadvertently introduced between those switches, a switching loop is created.

Routing loops

Occur when Router A believes the next hop is Router B, while Router B thinks the next hop is Router A, creating a circular reference.

This situation can continue until the Time to Live (TTL) expires, causing packets to be dropped.

Are often the result of misconfigurations, especially with static routing.

Using traceroute can help identify the loop, as it will reveal repeated entries in the routing table until it reaches the TTL limit.

Missing route

Occurs when there is no defined path for a packet to reach its destination, leading to the packet being dropped.

In this case, an ICMP "host unreachable" message is sent back to the source device, informing it of the error. When pinging between devices, a missing route can result in receiving a "destination host unreachable" response.

To resolve this, check the routing tables to ensure that the appropriate routes are configured for both ingress and egress traffic.