I am managing a network that sporadically has network outages that present as follows

  • no TCP or ICMP traffic is working between any devices on the network. Two computers with valid ip addresses are unable to ping each other

  • UDP, ARP, SSDP, and some other protocols do seem to be successfully communicating between devices in Wireshark

  • power cycling all of the network switches (not router, just switches) seems to temporarily resolve the problem

The switches are unmanaged. There are no red lights on the switches or anything suspect. Just green and a few orange link lights (indicating 10/100 connectivity instead of gigabit).

What are some troubleshooting steps I can follow to narrow down the problem.


You did not say how many switches or the topology, so that makes it a bit harder. First, is it possible that you have a loop in the network? Since the switches are unmanaged, spanning tree would not exist to break a loop and you can have broadcast storms. Even a device with two interfaces could cause a loop.

After that, can you ping devices on the same switch as a host? Then ping out to a device on the next switch. You can do that on multiple places to see where it does not work. That should help narrow down the fault

  • 4 switches. 1 switch with an uplink to each of the other 3 – Jeff Jan 10 at 2:57
  • There should not be a loop and I did double check the wiring, but I can’t be 1000% positive given the number of cables (4 x 48) – Jeff Jan 10 at 2:58
  • On the UDP packets you see, are those directed to a broadcast or multicast address? If so, that would explain why you do not see other traffic. When things go bad, it could be a bad client sucking up the bandwidth. You can try disconnecting each of the uplinks and see when the problem goes away. When it does, I would start to look on that lower switch. With that large an environment and what sounds like business critical needs, I would suggest an inexpensive switch to provide some isolation between the switches with spanning tree, plus give you some diagnostics. – Kevin Mason Jan 10 at 19:29
  • Can you say a bit more? You mean an inexpensive managed switch? – Jeff Jan 10 at 23:53
  • I ran Capsa on the network’s DC and observed two ARP request storms in a period of 24 hours. Each came from a different device - one from a desktop and one from a Brother printer. Does this point at anything? – Jeff Jan 11 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.