Switch Activity Lights Flashing at the same Time

[reeceythelegend]

The connected ports on my network switch always flash at the same time, they will flash independently when there is more traffic to/from one device but they will always all flash at the same time inconsistently.  

 

There is no looped connection in the network and I don't know what else could be causing this. I've ran wireshark to see if there are widespread requests that could be causing it but there aren't, just the usual arp requests and general traffic. It's like there is certain traffic/packet that goes to every device at the same time (this may be normal, I'm not hugely clued up on networking)

 

I was wondering if anyone has come across this before or have any ideas as to what would be causing this. 

 

Thanks

[mynameisjuan]

2 hours ago, reeceythelegend said:

just the usual arp requests

How much ARP are you seeing? On a relatively small network you wont see it often. 

 

Simultaneous flashing is either:

-Loop

-Broadcast

-STP

-Multicast

 

So if you are seeing constant arp request you will see all the lights flash at once. Its a broadcast. But it might also be multicast for the plethora of IOT device available now that are constantly broadcasting. 

 

Without further info there is not much we can give you. Just filter out broadcast and multicast in wireshark and go from there. 

[reeceythelegend]

1 hour ago, mynameisjuan said:

How much ARP are you seeing? On a relatively small network you wont see it often. 

 

Simultaneous flashing is either:

-Loop

-Broadcast

-STP

-Multicast

 

So if you are seeing constant arp request you will see all the lights flash at once. Its a broadcast. But it might also be multicast for the plethora of IOT device available now that are constantly broadcasting. 

 

Without further info there is not much we can give you. Just filter out broadcast and multicast in wireshark and go from there. 

With my basic wireshark skills I can tell you from one capture I just did that there were 98 arp requests in 60 seconds which accounted for 1.8% of all traffic. 

 

EDIT: The requests were coming from my router but I powered off the router and the lights still kept flashing in unison. Loop detection is enabled on the network switch.

[Alex Atkin UK]

Do you have media servers or other devices that use uPNP?

With modern devices a LOT of them broadcast their capabilities over the network constantly, resulting in seeing this kind of activity.  For example I have several on my network that support Chromecast, Airplay, etc - they all add extra background traffic.

[reeceythelegend]

4 minutes ago, Alex Atkin UK said:

Do you have media servers or other devices that use uPNP?

With modern devices a LOT of them broadcast their capabilities over the network constantly, resulting in seeing this kind of activity.  For example I have several on my network that support Chromecast, Airplay, etc - they all add extra background traffic.

I have a plex server, Smart TVs and Sky Q boxes that are castable to

[Alex Atkin UK]

Those are prime candidates for the traffic, as well as the router you already identified.

[mynameisjuan]

20 hours ago, reeceythelegend said:

With my basic wireshark skills I can tell you from one capture I just did that there were 98 arp requests in 60 seconds which accounted for 1.8% of all traffic. 

 

EDIT: The requests were coming from my router but I powered off the router and the lights still kept flashing in unison. Loop detection is enabled on the network switch.

Well that is the case then. ARP is broadcast. I guess look through the capture and see what IP its trying to reach and then you find out why. Its trying to find a device but cannot