Revision history [back]

I think the answer here should be - it depends... Depends on:

• environment you're capturing on;
• capture timeframe.

If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.

Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "portfast" mode (for Cisco). But you must be aware of consequences.

10% ARP - usually nothing special, depend on how large you broadcast domain is and on how many live devices are in it.

As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.

I think the answer here should be - it depends... depends...

Depends on:

• environment you're capturing on;
• capture timeframe.

If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.

Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "portfast" mode (for Cisco). But you must be aware of consequences.

10% ARP - usually nothing special, depend on how large you broadcast domain is and on how many live devices are in it.

As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.

I think the answer here should be - it depends...

Depends on:

• environment you're capturing on;
• capture timeframe.

If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.

Most of Logical-Link Control Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "portfast" mode (for Cisco). But you must be aware of consequences.

10% ARP ARP - usually nothing special, depend on how large you broadcast domain is and on how many live devices are in it.

As for IPv6 IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.

I think the answer here should be - it depends...

Depends on:

• environment you're capturing on;
• capture timeframe.

If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.

Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "portfast" mode (for Cisco). But you must be aware of consequences.

10% ARP - usually nothing special, depend depending on how large you broadcast domain is and on how many live alive devices are in it.

As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.

I think the answer here should be - it depends...

Depends on:

• environment you're capturing on;
• capture timeframe.

If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.

Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "portfast" mode (for Cisco). or access mode for Cisco (if I remember it correctly). But you must be aware of consequences.

10% ARP - usually nothing special, depending on how large you broadcast domain is and on how many alive devices are in it.

As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.

I think the answer here should be - it depends...

Depends on:

• environment you're capturing on;
• capture timeframe.

If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.

Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "portfast" "BPDU filter" mode or access mode for Cisco (if I remember it correctly). But you must be aware of consequences.

10% ARP - usually nothing special, depending on how large you broadcast domain is and on how many alive devices are in it.

As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.

I think the answer here should be - it depends...

Depends on:

• environment you're capturing on;
• capture timeframe.

If this is a Protocol Hierarchy for couple minutes of idle background traffic (as it seems like if I look at Bits/s column) - this is quite normal.

Most of Logical-Link Control frames are probably because of STP "heartbeat". You can turn them off moving port on a switch into "BPDU filter" mode or access mode for Cisco (if I remember it correctly). But you must be aware of consequences.

10% ARP - usually nothing special, depending on how large you broadcast domain is and on how many alive devices are in it.

As for IPv6 - this is the one I'd look at most. Because almost all IPv6 traffic is DHCPv6, this is a lot of packets lot of packets. It's a good idea to look at their source and type.