broadcast storm

A broadcast storm occurs when broadcast and multicast traffic overwhelms a network segment, consuming available bandwidth and causing severe performance degradation or complete network failure. Unlike unicast traffic (sent to a single destination), broadcast frames are copied to every port on a switch, and when these frames loop back into themselves due to redundant paths or misconfigurations, they multiply exponentially until the network becomes unusable.

The most common cause is a bridging loop: two or more switches connected by multiple links without proper spanning tree protocol (STP) enabled or configured. When a device sends a broadcast frame, the switches forward it out all ports except the incoming port. If that frame reaches another port on another switch connected back to the first, it gets rebroadcast, creating a cycle. Within seconds, the same broadcast frame circulates thousands of times, consuming all available bandwidth and CPU resources on every device in the loop.

Physical symptoms manifest quickly: network interfaces show 95 percent or higher utilization, end devices lose connectivity to servers and gateways, and ping latency becomes immeasurable. ARP requests generate storms of their own, as devices cannot resolve MAC addresses and keep retransmitting. Managed switches may show dramatically elevated CPU load as they process the same frame repeatedly. In industrial environments with real-time control traffic, even a few seconds of broadcast storm can interrupt critical operations.

Prevention and diagnosis

Spanning tree protocol (IEEE 802.1D or the faster RSTP variant, 802.1w) is the standard defense. When enabled on all switches, STP detects loops, selects a single active path between any two switches, and blocks redundant links until needed. BPDU frames (bridge protocol data units) exchange topology information; if loops are detected, blocked ports automatically unblock when the active path fails. Misconfiguration of STP priorities or port costs can itself cause performance issues, so deliberate topology design is necessary.

Detecting an active broadcast storm requires a managed switch with SNMP monitoring or network analyzer software that captures frame counts. Port mirroring or a network tap placed on a suspect link will show the repeating frames immediately. Industrial networks should also implement broadcast suppression limits at the hardware level, where switches can drop broadcast traffic exceeding a configured threshold (specified in packets per second), though this is a safety measure, not a cure.

The term reflects the sudden, overwhelming nature of the event: like a weather storm, it appears rapidly and disables normal function. In switched Ethernet environments, broadcast storms remain one of the fastest ways to take down an otherwise robust network, which is why STP and its successors remain mandatory in any critical infrastructure with redundant wiring.