ProfessorI remember the days when 100 broadcast packets per second could hang a 486...
Nowadays my inclination would be to just set a warning on "> 1000". Excess non-unicast is still bad, but unlikely to be traffic impacting bad - and if it is, discards and other thresholds should trigger.
So that would allow investigation in the case of a legitimately problematic non-unicast level, but not generate alerts for situations that are not impacting things, and would otherwise be considered noise alerts. And we should add a "top 25" graph for inbound non-unicast traffic on all interfaces to our default network dashboard, for people that are inclined to investigate this more closely....
(On our infrastructure, we have 200 non-unicast pps on our busiest 10 G ethernet trunks....)
Seem reasonable?
