Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running into a big issue at a small network i manage. This network is an Apple network, with airport extremes, expresses, mac book pro's, imac's, ipads, iphones etc...

I went to add something to this network today and noticed lights flashing like crazy on the switch. After noticing this I started wireshark and took a look at my firewall log file.

The line I see in the log files over and over is

Deny mdns/udp 5353 5353 1-Trusted Firebox udp flooding 123 255 (Internal Policy) proc_id="firewall" rc="101"

The source ip changes ( but the message stays the same.

I am having a big issue figuring out what is causing this. When i have my wireless accesspoints connected i can not connect to anything on the network. When i unplug them the network is ok and is not saturated with this traffic.

Anyone have any good ways to go about diagnosing this issue? I am not sure if this just started or if it has always been the case since i just noticed it now.

UPDATE: The message that i see when i ran wireshark is the following:

25 0.006498000 MDNS 135 Standard query response 0x0000 A, cache flush A, cache flush

share|improve this question
Maybe a loop somewhere? some weird bridgeing somewhere? – mulaz Nov 13 '12 at 0:42
I thought about it, it may have started after plugging in a Dlink Powerline AV500 adapter -… I wonder if plugging 2 of these kits into the same house would cause issues. – Dani Cela Nov 13 '12 at 0:44
are they wired to the same network on both sides? – mulaz Nov 13 '12 at 0:44
yep, probably where the loop has happened... I am surprised these units don't support more than one unit/ have some sort of binding protocol. Maybe they only want 1 connected to the main network and then you can have more than one secondary unit connected to devices. – Dani Cela Nov 13 '12 at 0:46
up vote 2 down vote accepted

Several machines on your network seem to be using multicast DNS.

You might be creating some sort of network loop. For example if packets are traveling from the physical network up one AP, which forwards it to the next AP, which sends it back to the physical network.

You should consider reviewing your switching/network hardware configuration as you seem to have a switching loop.

What is a switching loop? Check this:

share|improve this answer
The issue ended up being the other powerline adapter i plugged in. Dont plug in 2 kits into the same network, you end up creating a wonderful network loop that will bring your network to its knees. – Dani Cela Nov 13 '12 at 23:22

If it were a switch loop you'd see much more than just the MDNS traffic. With a switch loop ALL frames are endlessly forwarded through the loop and the network would become virtually unusable in very short order. If you can look at the CPU utilization on one of the switches that will also tell you whether or not a loop exists. If a loop exists the CPU utilization will max out (or be very close) and will stay that way until the loop is removed or the switch is power cycled (but if the loop still exists the CPU will max out again). Do you see the same frames multiple times in the Wireshark capture? If so, you have a loop. If not then you don't. What you more likely have is switch flooding due to a misconfigured or faulty device. Find the source of the frames and disconnect it from the network. Does the activity return to normal? Does the Wireshark capture look normal?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.