Really Big L2 Networks

GovernmentSecurity.org > System Security > Networking Security / Firewall / IDS / VPN / Routers

packet

Feb 12 2005, 07:13 AM

Hey hey,

Anyone out there have any experience with really large L2 networks? I'd like to get any opinions on how big they could grow. Would 64 thousand users on one network be too much? How about with Muchos-muchos broadcast suppresion? How about with monster switches with monster MAC tables?

I'm trying to build a case that 32K (a /17) would be the absolute MAX I would go especially when some Luser on the network gets zombied or starts scanning/flooding/whatnot. Right now 10k is working just peachy so they are thinking, why not 64k? Why not 128k?

--P>G>>

l0gic

Mar 10 2005, 01:48 AM

Why would you ever want that many users on one broadcast domain? I never like putting more than two 24-bit subnets on the same segment, and with good reason; it's not only impractical and unstable, it's insecure. Most switches, even the really advanced ones, won't support nearly that many addresses anyway. Aside from that, the impact from so much junk traffic would depend on the alloted bandwidth per host, as well as on the backbones.

packet

Mar 23 2005, 12:55 AM

QUOTE(l0gic @ Mar 9 2005, 05:48 PM)

Why would you ever want that many users on one broadcast domain?

Because I need to have that many users in one broadcast domain. Its an ISP thing. I agree that in general a /23 is preferable especially in the corporate world, but unfortunatly in the world of ISPs its not always possible. As I mentioned there is quite a bit of broadcast suppresion so really the only thing out there is ARP traffic and DHCP.

So far no issues have some up and we are at about 15k, If folks are interested I'll post a response if we find a limit to the size. I'm still trying to keep it at a /17 and I think that will work out just fine.

--P>G>>

easternerd

Mar 28 2005, 05:17 PM

hi packet,
Ive heard and had reports of /19 which is what is globally routable acceptable standards...
but /17 is kinda bit more burden.. though i dont have much experience analysing such huge traffic snarls..

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.


Help - Search - Member List - Calendar Full Version: Really Big L2 Networks GovernmentSecurity.org > System Security > Networking Security / Firewall / IDS / VPN / Routers packet Feb 12 2005, 07:13 AM Hey hey, Anyone out there have any experience with really large L2 networks? I'd like to get any opinions on how big they could grow. Would 64 thousand users on one network be too much? How about with Muchos-muchos broadcast suppresion? How about with monster switches with monster MAC tables? I'm trying to build a case that 32K (a /17) would be the absolute MAX I would go especially when some Luser on the network gets zombied or starts scanning/flooding/whatnot. Right now 10k is working just peachy so they are thinking, why not 64k? Why not 128k? --P>G>> l0gic Mar 10 2005, 01:48 AM Why would you ever want that many users on one broadcast domain? I never like putting more than two 24-bit subnets on the same segment, and with good reason; it's not only impractical and unstable, it's insecure. Most switches, even the really advanced ones, won't support nearly that many addresses anyway. Aside from that, the impact from so much junk traffic would depend on the alloted bandwidth per host, as well as on the backbones. packet Mar 23 2005, 12:55 AM QUOTE(l0gic @ Mar 9 2005, 05:48 PM) Why would you ever want that many users on one broadcast domain? Because I need to have that many users in one broadcast domain. Its an ISP thing. I agree that in general a /23 is preferable especially in the corporate world, but unfortunatly in the world of ISPs its not always possible. As I mentioned there is quite a bit of broadcast suppresion so really the only thing out there is ARP traffic and DHCP. So far no issues have some up and we are at about 15k, If folks are interested I'll post a response if we find a limit to the size. I'm still trying to keep it at a /17 and I think that will work out just fine. --P>G>> easternerd Mar 28 2005, 05:17 PM hi packet, Ive heard and had reports of /19 which is what is globally routable acceptable standards... but /17 is kinda bit more burden.. though i dont have much experience analysing such huge traffic snarls.. This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.