When I came into work this morning, I noticed that the network was acting slow. Apon thurther inspecition, I noticed that the network was being DoS attacked to all computers on the network.  I looked around and I noticed that all the switches were blinking all lights at the same time, which i though was odd.

I looked around and found one switch which was blinking randomly, with all lights on and off randomly. "What the h***" I thought and then unplugged it. Suddenly, the network restablised. I plugged it back it, became unstable again. It was a surecom switch which was causing the problem.

I didnt think it was possible for a switch to DoS attack a network. It wasnt on the main line to the servers, it was on one of the arms. Eg:

Servers ----------MAIN LINE----------------------------
                                          |
                                          |
                                          |
                                  -------
                                  |
                                  |
                              Switch
                               |    |
                               |    |
                  Bad Switch   switch (These computers were being affected also)

Its weird if u ask me. What weird experiences with switches have u had?

Well, the obvious thought is that a host or network that's hanging off of a node on that switch was causing the disruption.

Sometimes you have to cut off and arm to save the body

poetic at best

Meh, if the software for the box got corrupted or overwritten it could easily send out random signals without knowing what to actually send.

Hmm, you learn something new everyday

D**m Ciscos

That is pritty weird

Imagine my surprise after looking all over the network for over an hour

Are you sure it was the switch (eg, swapping out just the switch fixed the problem)?

I had similar symptoms at a company I used to work at that was a Managed Service Provider (eg, we used VLANs on the switches to segregate file/print and Internet access, and thus provided service to multiple customers in one building).  At some point, everyone in one building would complain of slow Internet access, and 9/10 times it would turn out to be either someone got infected with a worm/trojan, or some idiot left Kazaa running wide open and people were leeching stuff full-throttle (some customers paid for no firewall so I couldn't just filter it out).  We weren't really running a proper network monitoring solution, and these were just layer 2 switches, nothing fancy, so finding the offender consisted of me telneting into the individual switches (when i could connect to them at all) and staring at the frame sent/received rates for each port until I spotted which port was doing an abnormal amount of traffic, and then disable it and see if it helped.  Tedious, but effective.

However, it is not unknown for a network device to "freak out" and start spewing packets for no reason - look up "network chattering".

What would be most useful in these situations is to have some sort of network monitor/intrusion detection system running *internally* - eg, plug a hub between your firewall and your first switch, and plug the monitor/IDS into that, and trap the majority of traffic that way (and set alarms, etc.).  I did some brief investigation, and it looked like Snort could do what I wanted it to, but the company didn't want to change the status quo at the time, so I dropped it.  But then they went bankrupt, so revenge is mine!!