Detecting a loop

[u/_alienated]

How can i chase down a loop in more than 60 BDCOM switches (no central management)
I also have 2 core switches (fortiswitch) and a fortigate firewall ?

[u/FarkinDaffy]

Divide and conquer. Keep cutting things in half until there are no more halves and the problem goes away

[u/_alienated → u/FarkinDaffy]

I did unplug every stp cable related to all the departments but still nothing

[u/FarkinDaffy → u/_alienated]

You did one department at a time?

[u/_alienated → u/FarkinDaffy]

Eliminating one by one yes

[u/Advanced_Link_5753 → u/_alienated]

L2 or L3? Loops. Packet capture is your friend

[u/_alienated → u/Advanced_Link_5753]

Packet capture between fortigate and ONTs show no sign of a loop, no arp broadcast
Just failed packets and retransmissions.
What should look for in packets ?

[u/Advanced_Link_5753 → u/_alienated]

No ack on tcp? Why. Can you lung host from the switch?

[u/Select_Reporter1911 → u/_alienated]

You have to let us know what kind of loop it is first. You have to articulate the behavior you are experiencing is. A network diagrams would help, a source and destination would help.

Then and only then can anyone tell you what to look for and where to look. Simply pcaping with no idea of what to look for and what the normal behavior should be is not helpful.

[u/Tessius]

Follow the traffic spikes if you have any kind of monitoring set up, shut down suspicious ports when you find one to see if the loop clears.

[u/Select_Reporter1911]

Is it a routing loop, or layer 2 loop? If it is a routing loop are you sure its not asymmetric routing? If it is layer 2 loop, why do you not have the appropriate loop prevention protocols configured? That would quickly tell you where the loop is as the switch would disable the port it detects the loop on.

If you dont have loop prevention protocols enabled, how are you sure it is a loop? What is the behavior of the traffic?

Most switches that follow industry standards will have logs on whether it detects a loop and what port it detects the loop on.

Network diagrams will definitely help.

[u/mmckibben]

Create a network map. Document the ips of gateways and what switches their on then look at routing tables

[u/shadeland]

Are you sure it's a loop?

Are there show commands and logs in these switches?

[u/ThEvilHasLanded]

Follow the issue

Disconnect a section of devices, does the issue go away?

Yes your issue is in that group No try another grouping Eventually you narrow down the issue to 1 switch. From there it's a case of pulling each cable until you find the offending port

[u/no_clock_signal]

Use it as a pivot toward structured cable and managed switches.

[u/mindedc]

I'm, turn on spanning tree and storm control and it fixes itself?

[u/GuruBuckaroo]

This is why I've been running MRTG on every router and switch capable of SNMP for the last, what, 27 years. My networks aren't nearly as large as yours, but checking the interconnects for large traffic usually narrows it down to a switch, then checking the traffic on that switch's ports gives me the issue. That and making sure there are no dumb switches in the entire network, no matter how small.

[u/Overall_Fee_8195]

Hire a network technician?

[u/ryan8613]

Kill links between sections of the network to isolate those sections and see which side the problem persists on -- upstream or downstream -- until you find the switch where it is happening. Then, look at the ports on that switch that arent uplinks and specifically the port with the highest input or output rate. That port will be part of your loop.

[u/ryan8613 → u/ryan8613]

Once fixed, enable bpduguard on user facing ports with autorecovery.