How to distinguish between broadcast storm and network loop?

Although the principles of broadcast storm and network loop are different, their physical performances are similar: "the switch lights are flashing wildly, while the intranet packet loss or ping value becomes higher." As a network manager, you need to be able to quickly determine the cause of the failure, so as to develop different solutions. The main differences between the two are as follows:

Broadcast storms only occur under certain conditions, so broadcast storms are not sustainable. And the loop is persistent.

The broadcast storm is caused by a flaw in the local area network architecture, and the network loop is a network failure.

The network loop has a great impact on the network, and the packet loss and ping values are much more serious than the broadcast storm.

Broadcast storms need to be resolved by dividing the VLAN. The network loop only needs to unplug the loop device or network cable.

Experienced network managers can also distinguish between storms and loops by grabbing bags. If you do not know how to grasp the package analysis, you can also sum up the law of the fault to judge. Next, I'll introduce how the network health detection plug-in in WFilter distinguishes between broadcast storms and loops.

1. Normal network

The network health detection plug-in will send broadcast packets to detect the forwarding of broadcast packets, so as to judge. Under normal network conditions, there should be little difference between the broadcast packets sent and the actual broadcast packets received. As shown in the figure:

two。 Broadcast storm

When there is a broadcast storm in the local area network, many more broadcast packets will be detected, at least twice as many as those tested. As shown in the figure:

3. Network loop

The network loop is much more serious, and the broadcast packet detected is many times that of the test package. As shown in the figure:

In WFilter's "Network Health Detection plug-in", "broadcast Storm and Loop Detection", if it is a green icon, you can rest assured. If it is an alarm icon, it should be noted that the broadcast storm is more likely. If it is a red mark, then you need to check the network loop.