storm-control broadcast level [pct]
Configures broadcast storm control on a switch interface to limit the percentage of broadcast traffic, preventing network disruptions from excessive broadcasts.
Definition: storm-control broadcast level [pct] is a Cisco IOS interface config command. Configures broadcast storm control on a switch interface to limit the percentage of broadcast traffic, preventing network disruptions from excessive broadcasts.
Overview
The `storm-control broadcast level [pct]` command is a critical tool for managing broadcast traffic on Cisco switch interfaces. Broadcast storms occur when a network is overwhelmed by excessive broadcast frames, often due to loops, misconfigurations, or malicious attacks. This command limits the percentage of interface bandwidth that can be used for broadcast traffic, preventing such storms from degrading network performance or causing outages.
The concept behind storm control is simple: it monitors incoming broadcast traffic and drops frames once the configured threshold is exceeded, protecting the switch CPU and downstream devices from being flooded. Network engineers reach for this command when they observe high CPU utilization on switches, slow network performance, or broadcast-related errors. It is often used in conjunction with other security features like port security, DHCP snooping, and dynamic ARP inspection.
In the configuration workflow, storm control is typically applied to access ports connecting to end devices or to trunk ports where broadcast traffic could propagate across VLANs. Important IOS behavior includes that the command is applied per interface and takes effect immediately; the configured percentage is based on the total bandwidth of the interface. The command is available in privileged EXEC mode (config-if) and does not require additional privilege levels.
The running configuration is updated immediately, and the setting is saved to startup-config with `write memory`. Note that storm control can also be configured for multicast and unicast traffic using similar commands (`storm-control multicast level` and `storm-control unicast level`). For broadcast storms, this command is the primary defense, but it should be complemented with loop prevention mechanisms like Spanning Tree Protocol (STP) and BPDU guard.
Understanding the threshold is crucial: setting it too low may drop legitimate broadcast traffic (e.g., ARP requests), while setting it too high may not prevent storms effectively. The default is no storm control, meaning all broadcast traffic is allowed. The command can be verified with `show storm-control [interface]` and `show interfaces [interface]` to see drops.
In summary, `storm-control broadcast level` is an essential security and performance command that every CCNA/CCNP candidate must master.
storm-control broadcast level [pct]When to Use This Command
- Limiting broadcast traffic on an access port connected to a user segment to prevent broadcast storms from affecting the entire VLAN.
- Protecting a trunk link from broadcast storms originating from a misconfigured or malicious device in another VLAN.
- Controlling broadcast traffic on a port connected to a server that generates high broadcast rates, ensuring stability for other devices.
- Enforcing traffic policies on a port connected to a legacy device that may send excessive broadcasts due to bugs or misconfiguration.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| pct | <0-100> | The percentage of interface bandwidth allowed for broadcast traffic. Valid values are from 0 to 100. A value of 0 blocks all broadcast traffic, while 100 allows unlimited broadcasts. Common mistakes include setting the value too low (causing legitimate broadcasts to be dropped) or too high (rendering storm control ineffective). It is recommended to start with a value like 20% and adjust based on network requirements. |
Command Examples
Setting broadcast storm control to 50% on an interface
interface GigabitEthernet0/1
storm-control broadcast level 50Switch(config-if)#storm-control broadcast level 50 Switch(config-if)#
The command sets the broadcast storm control threshold to 50% of the interface bandwidth. No output is displayed upon successful configuration; the prompt returns without error.
Verifying storm control configuration
show storm-control broadcastInterface Filter State Upper Lower Current --------- ------------ ---------- ---------- ---------- Gi0/1 Forwarding 50.00% 50.00% 0.00% Gi0/2 Blocking 30.00% 20.00% 35.00%
Interface: The interface name. Filter State: 'Forwarding' means traffic is passing; 'Blocking' means storm control is actively dropping traffic. Upper: The rising threshold (percentage of bandwidth) that triggers storm control. Lower: The falling threshold (percentage) at which storm control stops dropping traffic. Current: The current broadcast traffic percentage. In this output, Gi0/1 is forwarding with 0% broadcast traffic, while Gi0/2 is blocking because current (35%) exceeds the upper threshold (30%).
Understanding the Output
The 'show storm-control broadcast' command displays per-interface storm control status. The 'Filter State' indicates whether the interface is forwarding or blocking broadcast traffic. 'Upper' and 'Lower' are the configured thresholds; typically they are set to the same value unless a hysteresis range is configured.
'Current' shows the real-time broadcast traffic percentage. A healthy interface shows 'Forwarding' with a current value below the upper threshold. If 'Current' exceeds 'Upper', the interface enters 'Blocking' state and drops broadcast traffic until 'Current' falls below 'Lower'.
Watch for interfaces that frequently toggle between states, indicating a potential broadcast storm issue. Also, note that storm control only affects broadcast, multicast, and unknown unicast traffic; normal unicast forwarding is unaffected.
Configuration Scenarios
Limit Broadcast Traffic on an Access Port Connected to a User PC
A user PC is connected to a switch port and is generating excessive broadcast traffic due to a misconfigured network driver. This scenario configures storm control to limit broadcasts to 10% of the interface bandwidth, preventing the storm from affecting other devices.
Topology
PC1---(Fa0/1)SW1Steps
- 1.Step 1: Enter global configuration mode: SW1> enable
- 2.Step 2: Enter interface configuration mode: SW1# configure terminal
- 3.Step 3: Select the interface: SW1(config)# interface FastEthernet0/1
- 4.Step 4: Configure storm control for broadcasts: SW1(config-if)# storm-control broadcast level 10
- 5.Step 5: Exit and verify: SW1(config-if)# end
- 6.Step 6: Verify configuration: SW1# show storm-control FastEthernet0/1
! Enter interface configuration interface FastEthernet0/1 storm-control broadcast level 10 ! End
Verify: Use `show storm-control FastEthernet0/1` to display the configured level and any drops. Expected output shows 'Broadcast: 10.00%' and counters for dropped packets.
Watch out: If the port is a trunk, storm control applies to all VLANs on that trunk. Ensure the threshold is appropriate for the aggregate broadcast traffic.
Configure Storm Control on a Trunk Port to Protect Against Broadcast Storms from a Downstream Switch
A trunk link connects two switches. A misconfigured downstream switch is flooding broadcasts across the trunk, causing high CPU on the upstream switch. This scenario sets storm control to 50% on the trunk port to limit broadcast propagation.
Topology
SW1(Gi0/1)---trunk---(Gi0/2)SW2Steps
- 1.Step 1: Enter global configuration mode: SW1> enable
- 2.Step 2: Enter interface configuration mode: SW1# configure terminal
- 3.Step 3: Select the trunk interface: SW1(config)# interface GigabitEthernet0/1
- 4.Step 4: Configure storm control: SW1(config-if)# storm-control broadcast level 50
- 5.Step 5: Optionally, configure the action when threshold is exceeded: SW1(config-if)# storm-control action shutdown
- 6.Step 6: Exit and verify: SW1(config-if)# end
- 7.Step 7: Check storm control status: SW1# show storm-control GigabitEthernet0/1
! Configure trunk port with storm control interface GigabitEthernet0/1 description Trunk to SW2 switchport mode trunk storm-control broadcast level 50 storm-control action shutdown ! End
Verify: Use `show storm-control GigabitEthernet0/1` to see the threshold and any drops. If the action is shutdown, the port will be err-disabled if the threshold is exceeded; use `show interfaces status err-disabled` to check.
Watch out: The `storm-control action shutdown` option is often forgotten. Without it, the switch only drops excess traffic but does not disable the port, which may be desirable or not depending on the security policy.
Troubleshooting with This Command
When troubleshooting broadcast storms, the `storm-control broadcast level` command is both a preventive measure and a diagnostic tool. Healthy output from `show storm-control` shows the configured threshold and zero dropped packets. Problem indicators include a high number of dropped packets (indicating the threshold is being exceeded) or an err-disabled port if the shutdown action is configured.
Common symptoms that this command helps diagnose include high CPU utilization on the switch, slow network performance, and excessive broadcast traffic observed in packet captures. A step-by-step diagnostic flow: 1) Identify the affected interface using `show interfaces` or `show processes cpu` to see which port has high broadcast rates. 2) Check storm control configuration with `show storm-control [interface]`. 3) If storm control is not configured, apply a threshold (e.g., 50%) and monitor drops. 4) If drops are occurring, investigate the source of broadcasts using `show mac address-table` and `show arp` to locate the offending device. 5) Correlate with `show interfaces [interface]` to see input errors or broadcast counters. 6) Use `debug storm-control events` (with caution) to see real-time threshold events. The output of `show storm-control` includes fields like 'Broadcast', 'Multicast', 'Unicast' thresholds and 'Drop Counters'.
Focus on the broadcast drop counter; if it increments, the threshold is too low or there is a genuine storm. Also, check the 'Current' rate (if supported) to see real-time traffic levels. Correlating with `show interfaces` output: a high 'Broadcast' rate (in packets/sec) indicates potential issues.
If the storm control is dropping packets but the broadcast rate remains high, consider lowering the threshold or investigating the source. In some IOS versions, storm control statistics are also available via `show storm-control history`. Remember that storm control operates on ingress traffic only; it does not affect egress broadcasts.
For comprehensive troubleshooting, combine with `show spanning-tree` to check for loops and `show port-security` for security violations. The command is most effective when thresholds are set based on baseline traffic patterns; use `show interfaces` to measure normal broadcast rates before configuring.
CCNA Exam Tips
CCNA exam tip: Storm control thresholds are percentages of interface bandwidth, not absolute values. Remember that the default action is to filter (drop) excess traffic, not to send SNMP traps unless configured.
CCNA exam tip: You may be asked to configure storm control on a specific interface to limit broadcast traffic to 20% of bandwidth. Use 'storm-control broadcast level 20' in interface configuration mode.
CCNA exam tip: The 'show storm-control' command can verify the configuration. Know that 'Filter State' can be 'Forwarding' or 'Blocking'.
CCNA exam tip: Storm control is a Layer 2 feature; it does not apply to routed ports unless configured as switchports.
Common Mistakes
Mistake 1: Forgetting to enter interface configuration mode before applying the command, resulting in a global configuration error.
Mistake 2: Setting the threshold too low (e.g., 1%) causing legitimate broadcast traffic (like ARP) to be dropped, disrupting network operations.
Mistake 3: Not verifying the configuration with 'show storm-control', leading to undetected misconfiguration.
storm-control broadcast level [pct] vs storm-control action shutdown
These two commands are often used together to configure storm control on a switch interface. The first sets the threshold for broadcast traffic, while the second defines the action to take when any storm (broadcast, multicast, or unicast) exceeds its threshold. They are commonly confused because the action command affects all storm types, not just broadcast.
| Aspect | storm-control broadcast level [pct] | storm-control action shutdown |
|---|---|---|
| Storm Type | Broadcast only | Broadcast, multicast, unicast |
| Configuration mode | Interface configuration | Interface configuration |
| Dependency | Required before action takes effect for broadcast | Requires a storm threshold to be configured |
| Effect when threshold exceeded | Traffic is suppressed (default action is filter) | Port is error-disabled |
| Recovery | Automatic when traffic subsides | Manual or via errdisable recovery |
| Typical use | Limiting broadcast traffic impact | Isolating a faulty endpoint causing storms |
Use storm-control broadcast level [pct] when you want to limit broadcast traffic but keep the port operational.
Use storm-control action shutdown when you want to completely disable a port that is experiencing any type of storm.
Platform Notes
In IOS-XE (e.g., Catalyst 3650/3850/9300), the syntax is identical: `storm-control broadcast level [pct]`. However, the output of `show storm-control` may include additional fields like 'Current' rate and 'Interval' in some versions. On NX-OS (e.g., Nexus 9000), the equivalent command is `storm-control broadcast level [pct]` but the configuration is applied under interface mode with `storm-control broadcast level [pct]` as well.
However, NX-OS uses a different verification command: `show storm-control [interface]` or `show running-config interface [interface]`. On ASA firewalls, storm control is not directly available; instead, use `threat-detection` or `connection rate limiting` for similar protection. For IOS-XR (e.g., ASR 9000), storm control is not supported; instead, use QoS policies to police broadcast traffic.
Differences between IOS versions: In older IOS 12.x, the command may require `storm-control broadcast level [pct] [pct]` where the second percentage is the lower threshold for recovery (falling below which stops dropping). In IOS 15.x and later, the single percentage is used, and the recovery threshold is implicitly 0 (no hysteresis). In IOS 16.x (IOS-XE), the behavior is similar to 15.x.
Always check the specific platform documentation, as some switches (e.g., Catalyst 2960) support only broadcast storm control, while others (e.g., Catalyst 3750) support multicast and unicast as well. The `storm-control action` options (shutdown, trap, or default drop) may vary by platform. For CCNA/CCNP study, focus on the standard IOS syntax and verify with `show storm-control`.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions