Multicast storm

["Wilson Chu" <wilson () above net>]

Has anyone ever seen that only one bogus packet caused multicast storm in a vlan environment?

In the following example, the first packet with src/dest MAC addresses 72:3a:20:63:6f:9/41:2d:63:6f:6c:6f caused other 
machines in
the network generated nearly 10Mbps traffic towards some multicast MAC addresses for few minutes in a 10/100 switched 
vlan.

Is there any way to prevent it or let those "amplify" devices not to re-send them?

19:27:07.080000 72:3a:20:63:6f:9 41:2d:63:6f:6c:6f 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 
570133376:570134836(1460)
ack 13531 58 win 8760 (DF)
19:27:07.080000 0:0:f8:5:60:8d 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760 (DF)
19:27:07.080000 0:e0:21:1:0:b1 1:0:5e:42:63:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760 (DF)
19:27:07.080000 0:a0:24:23:39:82 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.090000 0:a0:24:2a:5a:33 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.090000 0:60:97:e2:51:24 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.090000 0:a0:24:95:7a:34 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.090000 0:0:f8:5:60:8d 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760 (DF)
19:27:07.090000 0:a0:24:7:30:3d 1:0:5e:5:48:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760 (DF)
19:27:07.090000 0:a0:24:95:7a:34 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.090000 0:0:f8:5:60:8d 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760 (DF)
19:27:07.090000 0:60:97:e2:51:24 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.100000 0:60:97:e2:51:24 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.100000 0:60:97:e2:51:24 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.100000 0:e0:21:1:0:b1 1:0:5e:42:63:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760 (DF)
19:27:07.100000 0:a0:24:7:30:3d 1:0:5e:5:48:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760 (DF)
19:27:07.100000 0:a0:24:95:7a:34 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.100000 0:a0:24:2a:5a:33 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.100000 0:60:97:e2:51:8a 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.100000 0:a0:24:2a:5a:33 1:0:5e:7e:68:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.110000 0:a0:24:95:7a:34 1:0:5e:7e:67:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760
(DF)
19:27:07.110000 0:a0:24:7:30:3d 1:0:5e:5:48:1 0800 1514: 206.14.182.201.20 > 210.71.156.70.1062: . 0:1460(1460) ack 1 
win 8760 (DF)
<snip, a 7 MB file>

------
Wilson Chu
AboveNet Communications
http://www.above.net