 | 1 | initial version |
I think the answer here should be - it depends... Depends on:
If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.
Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "portfast" mode (for Cisco). But you must be aware of consequences.
10% ARP - usually nothing special, depend on how large you broadcast domain is and on how many live devices are in it.
As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.
| | 2 | No.2 Revision |
I think the answer here should be - it depends...
depends...
Depends on:
If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.
Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "portfast" mode (for Cisco). But you must be aware of consequences.
10% ARP - usually nothing special, depend on how large you broadcast domain is and on how many live devices are in it.
As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.
| | 3 | No.3 Revision |
I think the answer here should be - it depends...
Depends on:
If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.
Most of Logical-Link Control Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "portfast" mode (for Cisco). But you must be aware of consequences.
10% ARP ARP - usually nothing special, depend on how large you broadcast domain is and on how many live devices are in it.
As for IPv6 IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.
| | 4 | No.4 Revision |
I think the answer here should be - it depends...
Depends on:
If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.
Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "portfast" mode (for Cisco). But you must be aware of consequences.
10% ARP - usually nothing special, depend depending on how large you broadcast domain is and on how many live alive devices are in it.
As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.
| | 5 | No.5 Revision |
I think the answer here should be - it depends...
Depends on:
If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.
Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "portfast" mode (for Cisco). or access mode for Cisco (if I remember it correctly). But you must be aware of consequences.
10% ARP - usually nothing special, depending on how large you broadcast domain is and on how many alive devices are in it.
As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.
| | 6 | No.6 Revision |
I think the answer here should be - it depends...
Depends on:
If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.
Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "portfast" "BPDU filter" mode or access mode for Cisco (if I remember it correctly). But you must be aware of consequences.
10% ARP - usually nothing special, depending on how large you broadcast domain is and on how many alive devices are in it.
As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.
| | 7 | No.7 Revision |
I think the answer here should be - it depends...
Depends on:
If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.
Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "BPDU filter" mode or access mode for Cisco (if I remember it correctly). But you must be aware of consequences.
10% ARP - usually nothing special, depending on how large you broadcast domain is and on how many alive devices are in it.
As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.
