Troubleshooting Loops: IPv4 ID/TTL and Addressing Notes

Troubleshooting Loops: IPv4 ID/TTL and Addressing Notes
Before I start, let the first cover a very common question I get asked. I will not be providing vendor specific information on this troubleshooting example. Nor will I be sharing the trace file.
The goal of this article and video, is to introduce you to the methodology, tips and tricks, and other things that you may not have thought of when you perform protocol analysis.
On to the problem; I covered a little bit about this in previous articles when I was talking about making a larger trace file manageable.
The client is complaining that the network has performance brownouts and wireless clients tend to get dropped off. So, I asked them to connect his computer to any port on that same deal and start a capture for a few minutes and then stop it, and send it to me. I then filtered and the capture device’s traffic and will go through the remaining packets and this exercise.
In the video you will see how I leverage the IP identifier, time to live and MAC addresses to determine what is happening. When I present or teach, I stress the goal of troubleshooting is to either prove what the issue is NOT or to figure out where your test point is with the final target being identifying the root cause.
Spoiler alert, the high packet rate of small broadcast packets is causing the problem.

[@elcabesion]

nice work!

[@thetechfirm]

thanks

[@DG-if3gs]

perfect example. keep going mate, thanks

[@thetechfirm]

thanks for watching and for the support

[@LogicArray]

Many thanks Tony
Q if possible
How do the station teaming might create a loop as layer 2 loop?

[@thetechfirm]

ive seen switches get confused with the virtual mac

[@LogicArray]

@thetechfirm me too, and more that I seen layer 3 switch routed port making layer 2 loop for a while. However I believe virtual mac will not make actual loop instead it makes mac flapping. If ip forwarding is enabled then it would or there is a bug in nic Driver. Many thanks