I have been seeing a weird problem that I can't reproduce on demand and have a suspicion on the root cause.
The Issue: Intermittently the entire network goes down until I walk around and unplug whatever computer is causing the spanning tree flood.
Topology: I've got 2 Cisco unmanaged gigabit switches connected via gigabit gbic. Both switches have the corresponding port next to the gigabit gbic port unoccupied so that the up-link functions as designed. Both Switches are Cisco and the same family (SG100 and SG102) so it's not a matter of incompatibility.
I've taken a wireshark capture directly connected to the culprit machine as well as connected via the switch and BOTH yield the same spanning Tree flood causing the MAC PAUSE frame to slow stuff down which kills the network.
Probable culprit but unable to replicate issue "YET" is that this seems to usually occur AFTER the following occurs: 1. User undocks their laptop from their docking station and connects to WiFi 2. User is done with need for laptop away from desk and re-docks 3. User's laptop re-connects via Ethernet on the docking station 4. Sometimes crashes entire network.
Since I've been unable to replicate the issue on demand, how could I build a filter of some sort for Wireshark to capture only the packets that would resemble an echo (NOT ICMP ECHO) more like duplicated traffic causing the initial storm before it goes nuts with spanning tree?
This way I could run the capture for days or weeks until it occurs again. Below is what I'm seeing after the network goes down in wireshark.
Since these are not managed switches they don't even support STP so I'm boggled on why it always ends with spanning tree traffic. Also the source MAC address does not exist in a natural configuration and I only know the affected workstation after the fact and it also is always frozen or occasionally gotten a BSOD. It's been a LONG time since I've seen a BSOD when this happens but the system frozen occurs every time and there is no minidump and yes it's configured.
Other things I've already eliminated: Cabling or cabling loop(s) event logs - just show time loss between frozen time and reboot no dumps when frozen updated to Dell's latest certified drivers and BIOS rebooted everything (again intermittent but usually after a undock, connecft to WiFi, re-dock and auto connect to ethernet pattern)