What is a broadcast storm, and what causes one?
A broadcast storm is an overwhelming flood of broadcast frames that can disable a network within seconds.
* A broadcast storm fed by a switching loop. — Karol508, CC0, via Wikimedia Commons. *
A broadcast storm occurs when broadcast (or multicast/unknown unicast) frames loop endlessly between switches, multiplying with each pass. Each switch forwards the frame out all ports, creating exponential growth.
Causes:
- Layer 2 loops — the primary cause when STP (Spanning Tree Protocol) is missing or misconfigured
- Faulty NIC (Network Interface Card) — a malfunctioning network card continuously generating broadcasts
Why broadcasts are especially dangerous:
- Layer 2 broadcasts (like ARP (Address Resolution Protocol) Requests) are extremely common in normal operation
- Multicasts are typically forwarded the same way as broadcasts
- IPv6 doesn't use L2 broadcast, but ICMPv6 (Internet Control Message Protocol version 6) Neighbor Discovery uses L2 multicasts — still vulnerable
Prevention: Some form of spanning tree must be enabled on switches in a redundant network. Spanning tree is enabled by default on Cisco switches.
Tip: A broadcast storm is like a hall of mirrors for Ethernet frames — one frame becomes thousands in milliseconds.
Go deeper:
Broadcast radiation (Wikipedia) — defines the storm and pins the usual cause (a switching loop), since L2 frames have no TTL (Time to Live).