Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
micahawitt
New Contributor III

High NIC usage

Ive noticed over the past few installs, 5.4 and 5.2.5, that after installing, and even after a reboot, my NIC shows it is getting data at 8MB/sec.  I have to shutdown forticlient and sometimes reboot, then will go to normal.

 

I first noticed this in my lab environment after installing EMS and pushing out to 3 servers, it eventually brought down my entire network and killed CPU and NIC traffic, i had to power off two esx hosts and my SAN, switch and start fresh.

 

Since then, i have noticed this on clients, mostly they are Windows 10 installs, yet there are a few Windows 7 pc's i notice this on.

 

Anyone else having related issues or possibly know?

 

Thank you

17 REPLIES 17
Chris_Lin_FTNT

Do you know what IP address it's sending traffic? I want to know if it is downloading AV signatures.

micahawitt

It appears to be the local IPv4 address, and I will have to see if I can do some more digging when it does occur, sometimes it happens a day or two later after a I boot up a pc, it will then just hang and CPU and NIC go berserk, there is a Host Service system proc that is going, I will have to get a screen shot for you so you can see exactly, but either a reboot, or killing that service seems to help.

 

I will work on getting pics and more details, it appears however that its not trying to grab AV signatures, yet just causes a broadcast storm that brings things down.

 

Stay tuned...

Chris_Lin_FTNT

It will be helpful to identify the type of traffic.

 

You case reminds me a traffic storm in my network, which turned out to be some IGMP broadcast.

rossco

@micahawitt, did you end up getting to the bottom of your issue? I'm seeing the identical situation - end result is a broadcast storm that brings the network down.

micahawitt
New Contributor III

@rossco

 

I wish I could say I have, been still no able to get to the bottom of it.  I will say, that I have been using 5.2.5 lately with no issues on my PC's.  So perhaps something with 5.4.0 or maybe even a silent update.

 

I still have done nothing with EMS lately either since that was the killer that started it all.

ss198939

This problem occurs due to broadcast storm / unicast storm/multicast storm Ur client pc would be connected to any switch. Enable broadcast storm in that and limit the broadcast packets. In cisco i think below is the cli Storm control broadcast level 10 Storm control unicast level 10 Or u can check by placing ? After storm control
alantz

I know that's a work around, but I find it unacceptable that a software package is causing broadcast storms.

 

Alan

 

alantz
New Contributor

Chris,

 

Since b788 worked so well for me, would it be wise to deploy this across all of our workstations, or is there a future release for FortiClient coming out soon ?

 

Alan

 

 

Chris_Lin_FTNT

Hi, Alan,

 

FortiClient 5.4.1 release is scheduled for end of March. It's better to wait for a release build.

 

BTW, it's the application firewall which causes the issue. If you don't need it, you can disable this feature to work-around it for now.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors