What is Broadcast Storm?

Understanding Broadcast Storm

A broadcast storm is the uncontrolled accumulation of broadcast or multicast frames on a Layer 2 network, typically caused by a switching loop. Frames are forwarded out every port endlessly, multiplying until they consume all available bandwidth and switch CPU, degrading or collapsing the network for every connected device.

The storm starts when redundant links create a physical loop with no loop-prevention mechanism. Because Ethernet broadcast frames carry no TTL (time-to-live) field, a frame entering the loop is forwarded forever. Each switch floods the frame out all ports except the one it arrived on, so a single broadcast can replicate exponentially within milliseconds. Switch MAC address tables also become unstable as the same source appears on multiple ports, worsening the flooding.

This matters because a broadcast storm is both an availability failure and a security concern. It produces a denial-of-service condition that can take a segment offline, and attackers can deliberately trigger storms by injecting traffic or creating a loop with a rogue cable or device. Without controls, a single misplaced patch cable can halt an entire site, disrupting voice, monitoring, and access-control systems.

For example, an administrator accidentally connects two access-layer switch ports together with a patch cable, forming a loop. Within seconds users lose connectivity site-wide. Networks defend against this with Spanning Tree Protocol (STP, IEEE 802.1D) or Rapid STP (802.1w), which logically block redundant paths to keep a loop-free topology. Additional safeguards include storm-control thresholds on switch ports that rate-limit broadcast traffic, BPDU Guard to shut down ports that receive unexpected spanning-tree frames, and loop-detection features that error-disable an offending port automatically.