1. Causes

2. Prevention

3. MANET broadcast storms

4. References

Causes

Most commonly the cause is a switching loop in the Ethernet wiring topology (i.e. two or more paths exist between end stations). As broadcasts and multicasts are forwarded by switches out of every port, the switch or switches will repeatedly rebroadcast broadcast messages and flood the network. Since the Layer 2 header does not support a time to live (TTL) value, if a frame is sent into a looped topology, it can loop forever.

In some cases, a broadcast storm can be instigated for the purpose of a denial of service (DOS) using one of the packet amplification attacks, such as the smurf attack or fraggle attack, where smurf sends a large amount of ICMP Echo Requests (ping) traffic to a broadcast address, with each ICMP Echo packet containing the spoof source address of the victim host. When the spoofed packet arrives at the destination network, all hosts on the network reply to the spoofed address. The initial Echo Request is multiplied by the number of hosts on the network. This generates a storm of replies to the victim host tying up network bandwidth, using up CPU resources or possibly crashing the victim.^[3]

In wireless networks a disassociation packet spoofed with the source to that of the wireless access point and sent to the broadcast address can generate a disassociation broadcast DOS attack.^[4]

Prevention

• Switching loops are largely addressed with shortest path bridging or older spanning tree protocols. In Metro Ethernet rings it is prevented using the Ethernet Ring Protection Switching (ERPS) or Ethernet Automatic Protection System (EAPS) protocols.
• Filtering broadcasts by Layer 3 equipment, typically routers (and even switches that employ advanced filtering called brouters).
• Physically segmenting the broadcast domains using routers at Layer 3 (or logically with VLANs at Layer 2) in the same fashion switches decrease the size of collision domains at Layer 2.
• Routers and firewalls can be configured to detect and prevent maliciously inducted broadcast storms (e.g. due to a magnification attack).
• Broadcast storm control is a feature of many managed switches in which the switch intentionally ceases to forward all broadcast traffic if the bandwidth consumed by incoming broadcast frames exceeds a designated threshold. Although this does not resolve the root broadcast radiation problem, it limits broadcast radiation intensity and thus allows a network manager to communicate with network equipment to diagnose and resolve the root problem.

MANET broadcast storms

In a mobile ad hoc network (MANET), route request (RREQ) packets are usually broadcast to discover new routes.

These RREQ packets may cause broadcast storms and compete over the channel with data packets.

One approach to alleviate the broadcast storm problem is to inhibit some hosts from rebroadcasting to reduce the redundancy, and thus contention and collision.^[5]

References

• Dobrolet (disambiguation)
• Dobrolevo
• Dobro (Livno)
• Dobroljubci
• Dobromani
• Dobromerice
• Dobromerovići
• Dobromierz Commune
• Dobromierz (disambiguation)
• Dobromierz, Kuyavian-Pomeranian Voivodeship
• Dobromierz, Swietokrzyskie Voivodeship
• Dobromierzyce
• Dobromierz, Świętokrzyskie Voivodeship
• Dobromil (disambiguation)
• Dobromilice
• Dobromil, Lower Silesian Voivodeship
• Dobromil, Podlaskie Voivodeship
• Dobromir, Bulgaria
• Dobromir (given name)
• Dobromir Hriz
• Dobromir Jechev
• Dobromirka
• Dobromir Mitov
• Dobromir Tashkov
• Dobromiru River