topic Re: AP's being slammed by multicast requests? LLC packets are hitting 40,000. Our ssids are on different vlans. Any guidance one how to correct this problem is greatly appreciated. Thanks! in Aerohive Migrated Content

AP's being slammed by multicast requests? LLC packets are hitting 40,000. Our ssids are on different vlans. Any guidance one how to correct this problem is greatly appreciated. Thanks!

donotusemhudgen — Tue, 13 Nov 2018 00:41:26 GMT

AP's being slammed by multicast requests? LLC packets are hitting 40,000. Our ssids are on different vlans. Any guidance one how to correct this problem is greatly appreciated. Thanks!

Re: AP's being slammed by multicast requests? LLC packets are hitting 40,000. Our ssids are on different vlans. Any guidance one how to correct this problem is greatly appreciated. Thanks!

samantha_lynn — Tue, 13 Nov 2018 00:54:48 GMT

If you can run a packet capture, I can give you some places to look for this issue. The following guide will walk you through the packet capture process, for reference, depending on your HiveManager platform:

HiveManager Classic (myhive.aerohive.com): https://thehivecommunity.aerohive.com/s/article/Packet-Capture

HiveManager (formerly NG, cloud.aerohive.com): https://thehivecommunity.aerohive.com/s/article/Packet-Capture-in-NG

Re: AP's being slammed by multicast requests? LLC packets are hitting 40,000. Our ssids are on different vlans. Any guidance one how to correct this problem is greatly appreciated. Thanks!

jnesci — Tue, 13 Nov 2018 22:16:05 GMT

Matt,

What kind of devices are you using on your wireless network?

Re: AP's being slammed by multicast requests? LLC packets are hitting 40,000. Our ssids are on different vlans. Any guidance one how to correct this problem is greatly appreciated. Thanks!

donotusemhudgen — Tue, 13 Nov 2018 22:25:57 GMT

@Sam Pirok , thanks for your response. I got swamped yesterday and wasn't able to run wireshark, but I will get on that this morning.

@Joe Nesci , we have a mix of chromebooks and macbooks and the occasional teacher phone. Mostly chromebooks at this point.

Re: AP's being slammed by multicast requests? LLC packets are hitting 40,000. Our ssids are on different vlans. Any guidance one how to correct this problem is greatly appreciated. Thanks!

jnesci — Tue, 13 Nov 2018 22:45:34 GMT

I had the exact same problem with Chromebooks. Here's what I did to minimize my problems (hopefully you're managing them in the Google Admin Console):

1)Disable or Restrict Auto Updates

In Admin console go to:

Device Management

Chrome Management (on left)

Device Settings

Device Update Settings section

Turn off auto updates OR Restrict to version at most 69.*

2)Disable Caching/Pre-fetching

Device Management

Chrome Management (on left)

User Settings

User Experience section

DNS Pre-fetching - change to never

Network Prediction - change to Do Not predict network actions

Re: AP's being slammed by multicast requests? LLC packets are hitting 40,000. Our ssids are on different vlans. Any guidance one how to correct this problem is greatly appreciated. Thanks!

donotusemhudgen — Tue, 13 Nov 2018 22:54:24 GMT

Thanks @Joe Nesci , and yes we are managing in GAC. I've just updated those settings and we'll see what happens.

So what exactly was the correlation between those settings and wireless traffic?

Re: AP's being slammed by multicast requests? LLC packets are hitting 40,000. Our ssids are on different vlans. Any guidance one how to correct this problem is greatly appreciated. Thanks!

jnesci — Tue, 13 Nov 2018 23:10:51 GMT

Google thought it was a good idea to allow Chromebooks to receive updates from neighboring devices. Instead of each device getting them directly from Google, only one would get them from Google and the rest would get them from neighboring Chromebooks on your network. It does this by sending Multicast requests across your network to request the update locally rather than sending the request out your Internet circuit - hence a multicast storm.

The Pre-fetching is how Google makes their cheap $200 devices appear as fast as a $1,500 MacBook. Each time you visit a web site, the Google browser crawls the entire site and pre-caches any links on the site so when you click on a link, it already has that information pre-loaded and appears fast. If you have a class room with 30 students looking at a site that has links to 10 videos, imagine how much data is being pre-cached, and they may never even click on those videos.

I did a test with this last summer and when 30 devices went to a teacher web page with several links, you could watch the CPU on the AP jump to 80 - 100%. The Chromebooks would then appear to drop off the network. I turned off the Pre-caching and the CPU on the AP stayed at 10 - 15% under the same test.

Re: AP's being slammed by multicast requests? LLC packets are hitting 40,000. Our ssids are on different vlans. Any guidance one how to correct this problem is greatly appreciated. Thanks!

donotusemhudgen — Tue, 13 Nov 2018 23:20:46 GMT

@Sam Pirok , when I run wireshark I do get these 2 bits of info:

'new fragment overlaps old data'

'Transmission Control Protocol, Src Port: 56359, Dst Port: 52512, Seq: 739261400, Ack: 1, Len: 1448'

Re: AP's being slammed by multicast requests? LLC packets are hitting 40,000. Our ssids are on different vlans. Any guidance one how to correct this problem is greatly appreciated. Thanks!

samantha_lynn — Tue, 13 Nov 2018 23:43:51 GMT

Thanks for letting me know, but I've honestly never seen that error before. Maybe try a new packet capture? Did you alter the default port from 2002? If you send me a screen shot at communityhelp@aerohive.com, I'll try to look further in to it. Also are you using any filters in the packet capture? If you'd like assistance running the packet capture, you might want to open a case so a technician can run one with you.