A broadcast storm or broadcast radiation is the accumulation of broadcast and multicast traffic on a computer network. Extreme amounts of broadcast traffic constitute a broadcast storm. It can consume sufficient network resources so as to render the network unable to transport normal traffic.[1] A packet that induces such a storm is occasionally nicknamed a Chernobyl packet.[2]

Causes

edit

Most commonly the cause is a switching loop in the Ethernet network topology (i.e. two or more paths exist between switches). A simple example is both ends of a single Ethernet patch cable connected to a switch. As broadcasts and multicasts are forwarded by switches out of every port, the switch or switches will repeatedly rebroadcast broadcast messages and flood the network. Since the layer-2 header does not support a time to live (TTL) value, if a frame is sent into a looped topology, it can loop forever.

In some cases, a broadcast storm can be instigated for the purpose of a denial of service (DOS) using one of the packet amplification attacks, such as the smurf attack or fraggle attack, where an attacker sends a large amount of ICMP Echo Requests (ping) traffic to a broadcast address, with each ICMP Echo packet containing the spoof source address of the victim host. When the spoofed packet arrives at the destination network, all hosts on the network reply to the spoofed address. The initial Echo Request is multiplied by the number of hosts on the network. This generates a storm of replies to the victim host tying up network bandwidth, using up CPU resources or possibly crashing the victim.[3]

In wireless networks a disassociation packet spoofed with the source to that of the wireless access point and sent to the broadcast address can generate a disassociation broadcast DOS attack.[4]

Prevention

edit

MANET broadcast storms

edit

In a mobile ad hoc network (MANET), route request (RREQ) packets are usually broadcast to discover new routes. These RREQ packets may cause broadcast storms and compete over the channel with data packets. One approach to alleviate the broadcast storm problem is to inhibit some hosts from rebroadcasting to reduce the redundancy, and thus contention and collision.[5]

References

edit
  1. ^ "Internetwork Design Guide -- Broadcasts in Switched LAN Internetworks". DocWiki. Cisco. 1999. Archived from the original on 10 April 2018.
  2. ^ Chernobyl packet. Free On-line Dictionary of Computing. 17 February 2004. Retrieved 30 August 2013.
  3. ^ Chau, Hang (17 September 2004). "Defense Against the DoS/DDoS Attacks on Cisco Routers". SecurityDocs. Archived from the original on 11 December 2006.
  4. ^ "Disassociation Broadcast Attack Using ESSID Jack". ManageEngine. Archived from the original on 11 December 2006.
  5. ^ Ni, Sze-Yao; Tseng, Yu-Chee; Chen, Yuh-Shyan; Sheu, Jang-Ping (15–19 August 1999). The Broadcast Storm Problem in a Mobile Ad Hoc Network (PDF). MobiCom '99: The Fifth International Conference on Mobile Computing and Networking. Seattle, Washington, USA. pp. 151–162. ISBN 978-1-58113-142-0. Archived (PDF) from the original on 14 November 2019 – via the University of California, Berkeley.