Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Broadcast to unknown network broke the whole network

    Routing and Multi WAN
    4
    11
    67
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      patrick38 last edited by patrick38

      Hello,

      We have an issue for a few weeks we have no idea how to solve, I would like to have your help about this.

      We have a pfSense in version 2.4.5-RELEASE-p1.

      Let's say we have two local network (192.168.1.0/24 and 192.168.2.0/24).
      This morning, someone plugs a computer coming from an external network (128.0.2.0/24).
      The computer didn't have internet, but on the Pfsense we could see something like 150MB/s traffic coming from this computer, with a broadcast to 128.0.2.255 (UDP / Netbios)

      It's not the first time we have this, whatever the outside network it comes from, it happens regularly

      Our firewall rules are pretty strict, but I don't know if broadcast are blocked.
      When we have this issue, all our switchs are blinking simultaneously and fast.

      I don't think we changed anything, or at least not voluntarily, and it happens for something like 3 months (never hard this problem in 10 years before that)

      Have you any idea how we can solve this? Or at least where to look at?

      Let me know if you need more information.

      Thanks

      1 Reply Last reply Reply Quote 0
      • provels
        provels last edited by

        So if you take another computer of your own and hard code the IP to something in the 128.0.20.0 network, the same thing happens? Or just this other computer? Possibly a virus/trojan?

        Peder

        MAIN - pfSense+ 23.05-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD
        BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

        1 Reply Last reply Reply Quote 0
        • P
          patrick38 last edited by

          I didn't test yet, I will try this if there is no better idea.
          But it was not the same computer each time (so probably not a virus either)

          1 Reply Last reply Reply Quote 0
          • provels
            provels last edited by

            Sounds like a loop. I don't know if this is possible, but if a laptop has both Wi-Fi and physical card enabled and both Wi-Fi and hard link are offered, will it loop?

            Or maybe someone brought in a home switch and looped some ports.

            Peder

            MAIN - pfSense+ 23.05-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD
            BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

            A 1 Reply Last reply Reply Quote 0
            • A
              akuma1x @provels last edited by akuma1x

              @provels said in Broadcast to unknown network broke the whole network:

              Sounds like a loop. I don't know if this is possible, but if a laptop has both Wi-Fi and physical card enabled and both Wi-Fi and hard link are offered, will it loop?

              No, it doesn't do it like that. The laptop simply gets 2 IP addresses - 1 from the wired ethernet network, and 1 from the wifi network. It's called Multihoming.

              It works just fine, at least on my networks. I'm not saying it's right, but simply that it doesn't typically cause any problems at the network level.

              Jeff

              1 Reply Last reply Reply Quote 1
              • P
                patrick38 last edited by

                Hello,

                It's not a loop.
                Each time we solve the problem by unplugging the computer and rebooting switchs and Pfsense.

                We just disabled Netbios in the DHCP options to see if it change anything.
                Can IGMP Snooping in the switchs configuration help with this?

                1 Reply Last reply Reply Quote 0
                • provels
                  provels last edited by

                  Maybe a bum cable or port at the client end getting shorted?
                  Try the PC in another port.
                  Try another PC in same port.
                  ?

                  Peder

                  MAIN - pfSense+ 23.05-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD
                  BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                  1 Reply Last reply Reply Quote 0
                  • P
                    patrick38 last edited by

                    It's a different port each time :/

                    1 Reply Last reply Reply Quote 0
                    • johnpoz
                      johnpoz LAYER 8 Global Moderator last edited by johnpoz

                      Lets see a sniff of this traffic please.. Upload pcap, if your getting 150MBps should be easy to get a few packets to post up..

                      Why do you think its broadcast, because it ends with 255? .255 as last octet doesn't mean its directed broadcast unless the clients mask is /24.. If if your network was 128.0.0.0/22, 128.0.2.255 would just be a host address.

                      128.0.2 is owned by

                      inetnum: 128.0.2.0 - 128.0.2.255
                      netname: HELPNET-FARMA-SA
                      descr: HELPNET FARMA SA
                      descr: Str. Malu Rosu, nr 4
                      descr: Balotesti, Ilfov, Romania
                      geoloc: 44.603193 26.074194
                      country: ro

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 23.05 | Lab VMs CE 2.6, 2.7

                      1 Reply Last reply Reply Quote 0
                      • P
                        patrick38 last edited by

                        I just managed to reproduce the problem
                        If I put my computer on a random static IP outside the network (128.0.2.50/24) and plug it on any switch, it broke everything (switchs are blinking, no network for all other computers).

                        So, I can test some ideas and see if it's solved or not

                        1 Reply Last reply Reply Quote 0
                        • johnpoz
                          johnpoz LAYER 8 Global Moderator last edited by johnpoz

                          And this computer was flooding the network with broadcast?

                          Lets see this broadcast please via a pcap.. So can load it into wireshark.

                          But how would have anything to do with pfsense?

                          Just set a pc to use that IP

                          thernet adapter Ethernet 2:
                          
                             Connection-specific DNS Suffix  . :
                             Description . . . . . . . . . . . : Realtek PCIe GbE Family Controller #2
                             Physical Address. . . . . . . . . : 00-13-3B-2F-67-62
                             DHCP Enabled. . . . . . . . . . . : No
                             Autoconfiguration Enabled . . . . : Yes
                             IPv4 Address. . . . . . . . . . . : 128.0.2.50(Preferred)
                             Subnet Mask . . . . . . . . . . . : 255.255.255.0
                             Default Gateway . . . . . . . . . :
                             NetBIOS over Tcpip. . . . . . . . : Enabled
                          

                          No flooding..

                          Pfsense has no control or say in what a client puts on the network..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 23.05 | Lab VMs CE 2.6, 2.7

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post