Course contents

Chapter 12: Security FundamentalsLesson 5 of 14

Beyond CCNA (optional). This topic is not on the CCNA 200-301 exam. It is useful at work and in later study; skip it if you are preparing for the exam. (Layer 2 security on the v1.1 exam is DHCP snooping, DAI and port security (5.7).)

Storm control

Limiting broadcast, multicast and unicast floods per port: rising and falling levels, filter, shutdown or trap, and show storm-control.

Intermediate · 9 min read

Technical definition

Storm control is a switch feature that measures broadcast, multicast or unicast traffic arriving on a port, once a second, and drops that type of traffic (or shuts the port down) while it is above a configured level. It limits the damage a flood from one port can do to the rest of the VLAN.

One faulty network card, a whole VLAN slowed down

Users on VLAN 10 report that everything is slow, and the switch CPU is busy. The cause is PC C, whose network card has failed in a way that sends broadcast frames non-stop. A switch must flood every broadcast out of every other port in the VLAN, so every PC and the router spend their time receiving frames they do not need.

Gi1/0/1Gi1/0/2Gi1/0/3Gi1/0/24Gi0/1R1Gi0/1 192.168.10.1SW1VLAN 10PC AGi1/0/1PC BGi1/0/2faulty NICPC CGi1/0/3

Device key: R1 (router) · SW1 (switch) · PC A, PC B, PC C (computer)

Lines show the example’s network connections. The coloured path and envelope follow the current step; its text identifies the sender, receiver and traffic type.

Reading the addresses

IP labels identify interfaces or destinations. Subnet labels identify networks; /n is the prefix length. A router ID (RID) identifies a routing process and need not be a reachable interface.

An IP address alone is not a URL. A web URL includes a scheme such as https://; an address on a router or printer does not imply a website.

  • R1: Gi0/1 192.168.10.1
  • SW1: VLAN 10
  • PC A: Gi1/0/1
  • PC B: Gi1/0/2
  • PC C: Gi1/0/3
  1. 1. Without storm control: SW1 floods every broadcast from PC C out of every other port in VLAN 10.
  2. 2. With storm control on Gi1/0/3: SW1 measures broadcasts arriving on Gi1/0/3 each second. Above the rising level, it drops them.
  3. 3. The rest of the VLAN carries on: PC A and PC B are unaffected. Gi1/0/3 forwards broadcasts again once the level falls back below the falling threshold.

What storm control measures

Storm control watches traffic arriving on a port and compares it with a level you set, separately for each traffic type:

What storm control measures
What storm control measuresType; Typical cause of a flood. broadcast: A Layer 2 loop, a faulty network card, a misbehaving application multicast: Streaming or discovery traffic out of control unicast: Unknown unicast flooding; on some platforms it counts all unicast traffic, so check the platform guide before using itTypeTypical cause of a floodbroadcastA Layer 2 loop, a faulty network card, a misbehaving applicationmulticastStreaming or discovery traffic out of controlunicastUnknown unicast flooding; on some platforms it counts all unicast traffic,so check the platform guide before using it

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each item on the left, with what it means on the right.

The level can be a percentage of the port's bandwidth, bits per second or packets per second. The switch measures over one-second intervals. When traffic of that type goes above the rising level, the switch takes its action; with the default action it keeps dropping that traffic until it falls below the falling level. If you give no falling level, it is the same as the rising one.

Configuring storm control

For the threshold example below, assume Catalyst 2960-X with IOS 15.2(7)E in an isolated lab. Check the exact switch and release before applying it; these commands have not been run on a device.

interface range GigabitEthernet1/0/1 - 23 storm-control broadcast level 5.00 3.00 storm-control multicast level 10.00

Broadcasts above 5% of the port's bandwidth are dropped until they fall below 3%. Multicast above 10% is dropped until it falls below 10%. With no action command, the switch filters and the port stays up.

Optional alternative: packets per second

Choose this alternative only to practise a packet-rate threshold. It replaces Gi1/0/3's broadcast percentage setting; it does not add a second broadcast limit. The other ports keep their percentage settings. Return Gi1/0/3 to the percentage example before comparing it with the output below.

interface GigabitEthernet1/0/3 storm-control broadcast level pps 500 300

The same idea in packets per second: drop broadcasts above 500 per second until they fall below 300. Packet rates are easier to reason about for broadcast, which is mostly small frames such as ARP.

Then decide what else should happen when a port crosses the level:

Optional alternative: packets per second
Optional alternative: packets per secondAction; Command; Effect. Filter (default): none Drop the excess traffic of that type; the port stays up and recovers by itself Shutdown: storm-control action shutdown Put the port in err-disabled state, like a port security violation Trap: storm-control action trap Send an SNMP trap to the monitoring systemActionCommandEffectFilter (default)noneDrop the excess traffic of that type;the port stays up and recovers byitselfShutdownstorm-control action shutdownPut the port in err-disabled state,like a port security violationTrapstorm-control action trapSend an SNMP trap to the monitoringsystem

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.
errdisable recovery cause storm-control errdisable recovery interval 300

Optional, global configuration. With the shutdown action, bring err-disabled ports back after 300 seconds instead of waiting for someone to shut and no shut them.

Filtering is usually the better choice on access ports: the flood is contained and the user keeps working once it stops. Shutdown is stronger and makes sure someone looks at the device, at the cost of taking the user off the network.

Verifying storm control

The following output illustrates the original percentage example with default filtering. If you tried the PPS alternative, return to global configuration mode and restore the broadcast setting on Gi1/0/3 first. Keep the optional shutdown action out of this filtering exercise.

interface GigabitEthernet1/0/3 storm-control broadcast level 5.00 3.00 end

From global configuration on the isolated lab switch: restore the broadcast percentage thresholds on Gi1/0/3, then return to privileged EXEC. This changes the active lab configuration; it is not a read-only check.

Check the selected interface and traffic type with show storm-control GigabitEthernet1/0/3 broadcast. Confirm the configured units and upper/lower levels before interpreting the current rate. Do not expect a PPS configuration to produce the percentage example shown here. The example rates are authored, not measurements from your switch.

Example output written for this lesson, based on Cisco IOS documentation
SW1#show storm-control broadcast
Interface  Filter State   Upper        Lower        Current
---------  -------------  -----------  -----------  ----------
Gi1/0/1    Forwarding           5.00%        3.00%        0.02%
Gi1/0/2    Forwarding           5.00%        3.00%        0.01%
Gi1/0/3    Blocking             5.00%        3.00%       38.40%
Upper and Lower are the rising and falling levels. Current is the level measured in the last interval. Gi1/0/3 is at 38.4%, far above 5%, so it is Blocking: SW1 is dropping its broadcasts. The port is still up and still forwards PC C's ordinary unicast traffic.

Below the upper level can still mean Blocking

With upper 5% and lower 3%, a previously triggered filter can remain Blocking at 4%. In the same two-threshold example, forwarding resumes below 3%. Read the filter state together with both thresholds and the traffic history. A single current-rate value does not tell you which threshold was crossed earlier.

Threshold behaviour reference: Cisco Catalyst 2960-X IOS 15.2(7)E guide. Configured percentage thresholds are approximate on hardware; this is a teaching example, not an exact device capture.

The switch also logs a message when it starts filtering or shuts a port down, so show logging shows when the storm began. With the shutdown action, show interfaces status err-disabled lists the port with the reason storm-control.

Mistakes that turn a safety net into an outage

  • Levels set too low. ARP, DHCP and some discovery protocols are broadcasts or multicasts. A level close to normal traffic drops them during busy moments and causes intermittent faults that are hard to trace.
  • Expecting it to prevent loops. During a loop the switch still forwards up to the level on every port, and unicast frames still circulate. Spanning Tree and BPDU Guard prevent the loop; storm control limits the damage.
  • Shutdown on an uplink. If the uplink to the distribution switch crosses the level, shutdown takes a whole access switch off the network. Use filtering or a trap on uplinks.

Remember: storm control is configured per interface with storm-control broadcast|multicast|unicast level, measures incoming traffic each second against rising and falling levels, filters by default, and can instead shut the port down or send a trap. show storm-control shows Forwarding or Blocking per port.

Storm control in five lines

What to remember
  • It limits broadcast, multicast or unicast traffic arriving on a port, measured each second.
  • Levels are a percentage of bandwidth, bits per second or packets per second, with an optional lower falling level.
  • The default action filters the excess; action shutdown err-disables the port; action trap sends an SNMP trap.
  • show storm-control shows each port's levels, current rate and Forwarding or Blocking state.
  • It limits a flood's damage; Spanning Tree is still what prevents loops.

Test yourself on storm control

Predict · scenario 1

Gi1/0/3 has storm-control broadcast level 5.00 3.00 and no action command. Broadcasts arriving on it reach 20%. What happens?

Predict · scenario 2

show storm-control broadcast lists Gi1/0/7 as Blocking. What does that mean?

Predict · scenario 3

With upper 5% and lower 3%, the broadcast filter already triggered. The rate is now 4%. What is consistent with this two-threshold example?

Predict · scenario 4

Which problem does storm control NOT solve?

Predict · scenario 5

You want an access port to go err-disabled when its broadcasts exceed 1000 packets per second. Which commands do it?

FAQ

Does storm control replace Spanning Tree?
No. Spanning Tree stops loops from forming. Storm control only limits how much flooded traffic a port passes on while a flood is happening, whatever caused it. Use both: STP to prevent loops, storm control to limit the damage if something still floods.
What level should I set?
There is no single right number. Look at normal broadcast and multicast levels on the port first (show interfaces counters, or show storm-control while it is configured), then set the level well above normal and well below what would hurt the VLAN. Access ports are often given a few per cent of the link for broadcast; a level that is too low drops ARP and DHCP and causes faults of its own.
What happens when storm control has no action configured?
The switch filters: it drops the excess traffic of that type until the level falls back below the falling threshold, and the port stays up. The other actions are shutdown (the port goes err-disabled) and trap (an SNMP trap is sent).