Tuesday, December 1, 2020

Trying to piece the puzzle - Network Reflective Flooding from 2 PCs

I am attempting to understand an issue we faced this morning with our network. My first call came in and people could not connect to several systems. After getting onsite, I was able to pull up Wireshark and begin troubleshooting.

Before I get into the details, my question is, I understand the principals behind a broadcast storm and while we have multiple switches throughout our network, there are no redundant links, possible loops, STP issues, etc. The best thing I can come up with is the original PC caused something on PC2 to flake out and it somehow reflected and regenerated the traffic using the same IP and MAC as PC1 (original PC). But to me, this doesn't make sense. Has anyone ran across anything like this?

We do not have any fancy tools and use a lot of poor boy methods! Here is what I found.

  1. Flood of UDP traffic from one IP address (PC1) on a port that appears to be associated with Logitech ARX Drivers. Looks like the driver/service flaked out.
  2. Disconnected the PC1 from the network and the flood was still occurring from the IP address (it was a static assignment and I knew the PC1). Why is this still flooding with it disconnecting? The flood was from this disconnected PC1 on UDP Port 54915; Wireshark was also giving info on "54915 -> 54915 [BAD UDP LENGTH > PAYLOAD LENGTH]"
  3. Cycled the power on three switches; the problem still persisted. (the PC1 is still unplugged).
  4. We isolated it to a single switch. Moved the laptop (w/Wireshark) to that switch (which has been rebooted) and started pulling cables (to PC's and devices) to isolate the the device. We discovered when we disconnected PC2, the flood stopped. Connected it back, the flood started showing the same IP and MAC from PC1.
  5. At this time, both PC's are disconnected and we reconnected the switch to the network. Network is stable now; devices/equipment (except for those two PC's) are back online.
  6. On the PC2, we ran several different Security and process scans. Nothing turned up. No wild processes, etc. We rebooted the machine, reconnected to the network and it everything was normal.
  7. On the PC1, the source of the UDP Flood, we found several references on the internet that the Logitech ARX LCore.exe on port 54915. In the Logitech Drivers, we disabled the Mobile Service and Automatic Discovery. Restarted the program. I put the PC1 on an isolated network with the laptop and did not see anymore abnormal traffic. I rebooted the PC1 and it's now back on the network. Everything is good.

Is it possible for PC2 to reflect the UDP Broadcast traffic? I've never seen anything like this. I've seen were a single PC was the culprit, but nothing like this. It do not see any signs of compromise or breach. Just a driver that flaked out and caused a serious network glitch.

Anyone seen anything like this?



No comments:

Post a Comment