We have a basic network with 3 T1's. The problem we are having is we have Appletalk running on the network somewhere and it's using almost 1/3 of the total bandwidth. All our sniffer and tracker programs won't tell us where it's coming from. I was curious if anyone has experienced this before and what did you do to find and disable it.

When we have that problem, we do it the old fashioned way. Start shutting off switches until you find the segment that has the offending device, then unplug the devices one at a time until you see the traffic die. Viola', you've found it!

IIRC Appletalk has a large amount of protocol overhead caused by RTMP(which broadcasts the routing table) and NBP(which maps the network names to addresses). I don't recall if anything can be done to lower this, short of going to tcp/ip.

Sure you're not having router problems? I recall (many, many moons ago) having a router go bad that was literally *adding* packets to all of its traffic, KILLING our network. Took awhile to figure that one out.

We have a linux box running an application called Cricket http://cricket.sourceforge.net In a nutshell it's an snmp Trap that collects stats on switchports and router interfaces. Its not a quick fix for your problem, but it's been invaluable to me as far as tracking down systems with high errors, the bandwith on routers and switchports. I know it works well with Cisco stuff, but I can't comment on others.

You have any HP(or other brand) networked printers with it not disabled?

Just a stab in the dark guess.

Originally posted by MattS
You have any HP(or other brand) networked printers with it not disabled?

Just a stab in the dark guess.


Shit, somehow I missed that they're not running it intentionally...

Originally posted by mike
Shit, somehow I missed that they're not running it intentionally...

Mine came with them defaulted to ON. :mad:

Good luck. ;)

Originally posted by MattS


Mine came with them defaulted to ON. :mad:

Good luck. ;)

Yeah, and it's a wasteful damned protocol. I hate it.. and IPX/SPX :mad:

Originally posted by MattS
You have any HP(or other brand) networked printers with it not disabled?

Just a stab in the dark guess.

We have tons of them...:eek:

I checked our printer settings.. how do I see if it's enabled or not?

*found it... and yes it is enabled. about 90% of our printers are HP.. I have a long day ahead of me.

Thanks guys.:D

Originally posted by mike


Yeah, and it's a wasteful damned protocol. I hate it.. and IPX/SPX :mad:


Hey
Hello...........
Anyone out there?
HELLLOOOOOO!
I'm not going to shutup until someone answers me!!!!!! BLAH BLAH BLAH BLAH

:laughing:

good call on the printers MattS

Originally posted by HighToy


We have tons of them...:eek:

I checked our printer settings.. how do I see if it's enabled or not?

Do a print config. Jet Direct area, every printer is different. The second page is the EIO 1 Configuration page. Right hand column should say APPLETALK STATUS: DISABLED

I just pulled a list of all the IP's for all of the printers. so far all the one's I have checked have been enabled.

http://www.lex-con.com/protocols/apple.htm contains the packet header breakdown. You should be able to identify the source address from it and cross reference it to the ARP table in your switches. From there you should be able to ping the device, resolve its netbios or WINS name (if a Windows device).

If that doesn't help check your port statistics. The one with the higher traffic is probably your culprit, based on the fact that 1/3 of your entire bandwidth is being taken up by it.

HP Jetdirects come by default with all protocols enabled, so that is another possibility, though I have never had one put out that much traffic.

I none of that works take a router and start segmenting the network until you localize the segment with the offending machine.

Lastly - Do you have any Macs on your network? :flipoff2:

Just diasbling the printers took it from 34% to 14%:bounce2:

Originally posted by HighToy
Just diasbling the printers took it from 34% to 14%:bounce2:

:cool:

Thanks again. This really cleared alot up. Now I just have to hunt down the remaining 14.91% :D

Originally posted by HighToy
Just diasbling the printers took it from 34% to 14%:bounce2:

you used telnet right?

I believe you can disable the appletalk protocol through telnet anyway. I know you can set IP, etc.



or...



did you walk around to every HP printer?


:p

If you haven't already, install HP Jet Admin. Setup all the Jet directs from your desktop and then remove the Jet admin app.

Hate the app, but it is great for this stuff.