减少 Cisco SG300 上的广播流量

网络工程 播送 cisco-sg300
2021-07-13 16:01:04

我有一台 Cisco SG300 小型企业交换机,GUI 界面正在创建大量广播流量:源 IP(GUI IP):172.16.xx.254:5353,目标 IP(广播)224.0.0.251:5353

我在交换机上全局禁用了 Bonjour 和 CDP。

如何关闭此流量?(首选命令行答案,但 GUI 也可以。)


编辑 #1 - JFL 的回答促使我进行 Wireshark 捕获只是为了 100% 确定流量来自交换机......它是。控制 GUI 正在广播。我不需要也不希望这种情况发生。

没有在全球范围内启用 bonjour

Discovery - Bonjour菜单 Discovery: Enable 未选中, Bonjour Discovery Interface Control TableEMPTY

我错过了什么?

这是一个示例数据包:

Frame 60: 362 bytes on wire (2896 bits), 362 bytes captured (2896 bits) on interface 0
    Interface id: 0 (enp0)
    Encapsulation type: Ethernet (1)
    Arrival Time: Mar  3, 2017 16:14:17.875849274 EST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1488575657.875849274 seconds
    [Time delta from previous captured frame: 1.461698815 seconds]
    [Time delta from previous displayed frame: 4.999822643 seconds]
    [Time since reference or first frame: 43.461018609 seconds]
    Frame Number: 60
    Frame Length: 362 bytes (2896 bits)
    Capture Length: 362 bytes (2896 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:udp:mdns]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: 00:9e:1e:xx:xx:x1 (00:9e:1e:xx:xx:x1), Dst: IPv4mcast_fb (01:00:5e:yy:yy:yb)
    Destination: IPv4mcast_fb (01:00:5e:yy:yy:yb)
        Address: IPv4mcast_fb (01:00:5e:yy:yy:yb)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
    Source: 00:9e:1e:xx:xx:x1 (00:9e:1e:xx:xx:x1)
        Address: 00:9e:1e:xx:xx:x1 (00:9e:1e:xx:xx:x1)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 172.16.xx.254, Dst: 224.0.0.251
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes
    Differentiated Services Field: 0xe0 (DSCP: CS7, ECN: Not-ECT)
        1110 00.. = Differentiated Services Codepoint: Class Selector 7 (56)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 348
    Identification: 0x2e4f (11855)
    Flags: 0x00
        0... .... = Reserved bit: Not set
        .0.. .... = Don't fragment: Not set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 1
        [Expert Info (Note/Sequence): "Time To Live" != 255 for a packet sent to the Local Network Control Block (see RFC 3171)]
            ["Time To Live" != 255 for a packet sent to the Local Network Control Block (see RFC 3171)]
            [Severity level: Note]
            [Group: Sequence]
    Protocol: UDP (17)
    Header checksum: 0xca52 [validation disabled]
        [Good: False]
        [Bad: False]
    Source: 172.16.xx.254
    Destination: 224.0.0.251
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: 5353 (5353), Dst Port: 5353 (5353)
    Source Port: 5353
    Destination Port: 5353
    Length: 328
    Checksum: 0x6346 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    [Stream index: 0]
Multicast Domain Name System (response)
    Transaction ID: 0x0000
    Flags: 0x8000 Standard query response, No error
        1... .... .... .... = Response: Message is a response
        .000 0... .... .... = Opcode: Standard query (0)
        .... .0.. .... .... = Authoritative: Server is not an authority for domain
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...0 .... .... = Recursion desired: Don't do query recursively
        .... .... 0... .... = Recursion available: Server can't do recursive queries
        .... .... .0.. .... = Z: reserved (0)
        .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
        .... .... ...0 .... = Non-authenticated data: Unacceptable
        .... .... .... 0000 = Reply code: No error (0)
    Questions: 0
    Answer RRs: 1
    Authority RRs: 0
    Additional RRs: 0
    Answers
        VSDPb45501._csco-sb-vsdp._mdns._udp.local: type TXT, class IN
            Name: VSDPb45501._csco-sb-vsdp._mdns._udp.local
            Type: TXT (Text strings) (16)
            .000 0000 0000 0001 = Class: IN (0x0001)
            0... .... .... .... = Cache flush: False
            Time to live: 25
            Data length: 255
            TXT Length: 6
            TXT: type=0
            TXT Length: 9
            TXT: version=1
            TXT Length: 21
            TXT: refresh-age-timeout=0
            TXT Length: 10
            TXT: priority=0
            TXT Length: 14
            TXT: refresh-flag=0
            TXT Length: 34
            TXT: root-mac-address=00:9e:1e:xx:xx:x1
            TXT Length: 6
            TXT: cost=0
            TXT Length: 26
            TXT: transm-address=172.16.xx.254
            TXT Length: 23
            TXT: transm-interface=100049
            TXT Length: 16
            TXT: voice-vlan-id=10
            TXT Length: 16
            TXT: voice-vlan-vpt=5
            TXT Length: 18
            TXT: voice-vlan-dscp=46
            TXT Length: 43
            TXT: md5-auth=01af9cba5ed0218b0848195834e6a878ae

编辑 #2

我通过在控制台上扎根发现了以下内容。不知道这是否给任何人任何想法,但文档没有说明任何有用的信息。

show bonjour 
Bonjour global status: disabled
Bonjour L2 interfaces port list: none

Service   Admin Status   Oper Status
-------   ------------   -----------
csco-sb   enabled        enabled 
http      enabled        enabled 
https     enabled        enabled 
ssh       enabled        enabled 
telnet    enabled        disabled
4个回答

224.0.0.251 是苹果 Bonjour 协议使用的多播(而不是广播)地址,也是关联的多播 DNS ( rfc6762 )

所以有两个原因导致流量发送到这个多播地址:

  • 卓悦广告
  • .local DNS 名称的解析

因此,我会首先仔细检查 bonjour 广告是否已禁用(在管理 > 发现 - Bonjour 中。)但还要检查是否在任何地方都没有以 .local 结尾的 DNS 名称。

分析发送的帧(使用wireshark / tcdump / MS消息分析器)还可以确定它们是否实际上是bonjour发现消息

如果它实际上是 bonjour 发现数据包并且它真的关闭,那么我将使用最新软件升级交换机并查看它是否仍然存在,然后将问题提交给 Cisco。

不幸的是,它似乎是 Cisco IOS 中的一个错误:

https://quickview.cloudapps.cisco.com/quickview/bug/CSCum51028

这是一个 VSDP 数据包。思科为其小型交换机业务线提供了一种可怕的专有方式,用于在网络周围传达商定的语音 vlan。这很痛苦,会添加/删除 vlan,弄乱您的中继端口配置,并且似乎无法禁用。不过,您可能可以构建一个 ACL 并将其应用于每个端口。

VSDP 专利申请:http ://www.freepatentsonline.com/y2013/0259027.html

voice vlan state disabled配置命令将停止这些广播。