Definition of Broadcast Storm in Network Encyclopedia.
What is Broadcast Storm (networking)?
Broadcast Storm is a network condition in which so many broadcasts are occurring (for example, for address verification purposes) that normal communication is disrupted.
How It Works
Broadcast storms commonly occur on Ethernet networks where baseband transmission technologies allow only one station to transmit at a time.
The presence of broadcast storms often indicates that a networking component is malfunctioning and is continually sending out broadcast messages.
A typical situation might be a failed transceiver on a network interface card (NIC) that is continually sending out a stream of binary «ones».
During a broadcast storm, the wire is continually busy and no other station is able to transmit information over the network – so broadcast storms essentially bring down the network. Since routers often are not configured to forward broadcast frames between subnets, broadcast storms usually are confined to a single subnet.
Broadcast storms might also indicate that the bandwidth of your network is nearly saturated and needs to be upgraded.
What causes a broadcast storm?
High volume of requests for an IP address via DHCP
The Dynamic Host Configuration Protocol (DHCP) is the most common way for a networked host to obtain an IP address from a network controller.
Think about when you take your laptop to a coffee shop and hop on WiFi. Aside from clicking “I agree” to a legal disclaimer or entering in some credentials, you don’t need to worry about statically assigning yourself an IP address.
DHCP consists of a few key steps:
- Discover – always broadcast
- Offer
- Request
- Acknowledge
Depending on how things are configured, DHCP may be sent as broadcast or unicast (one to one) packets.
A storm of broadcast packets is sometimes expected behavior—for example, when a network is brought back online after an outage and all clients are attempting to negotiate an IP address.
The broadcast domain is too big
The amount of broadcast traffic you should see within a broadcast domain is directly proportional to the size of the broadcast domain—the number of hosts within the L2 VLAN or L3 subnet.
Many times, we see MSPs bringing on board clients with all of their hosts in the same broadcast domain, sometimes as large as a /16 subnet which can accommodate just over 65,000 possible addresses.
In this case, network segmentation is your friend. Place like groups of devices together in segments. This will reduce the number of “I’m here” broadcasts generated.
