2

First, I understand how switches work when they receive a broadcast frame. They will record the source MAC address on the incoming port (put it in the CAM table) and then flood the broadcast frame out of all ports in the source VLAN except for the port that it was received on.

If a switch receives an ARP with a source mac address of a host and a destination address of all F's and there is a network loop, does the switch end up sending the frame to the source host because of the loop.

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Commented Dec 17, 2020 at 16:50

2 Answers 2

3

You are describing a broadcast storm. It will not happen with a single switch because the switch will not send a frame out the interface on which it receives the frame, but with multiple switches, a frame could end up looping back to the original switch on a different interface.

This was a well-known problem with bridges before there were switches (switches are bridges). Radia Perlman came up with the spanning tree protocol in order to prevent switching loops. With multiple bridges, one bridge is selected as the root bridge, and every other bridge selects a single loop-free path toward the root, blocking other paths that may form a loop.

2
  • You can have a broadcast storm with a single switch with a loop on it as well, returning broadcast frames to the sender.
    – Zac67
    Commented Apr 11, 2020 at 20:22
  • 1
    @Zac67 if you plug a switch into itself, you get exactly what you deserve. :) (I've done that to quickly flatten two vlans. For those playing along at home, cisco switches will errdisable those ports -- vlan mismatch -- if cdp or lldp is enabled.)
    – Ricky
    Commented Apr 12, 2020 at 5:38
0

Broadcast frames are flooded to all ports (within the VLAN) but the one it was received from.

An ARP request is sent as a broadcast. When there is a loop on the switch, the already forwarded broadcast returns to the switch through the loop (twice actually) and is flooded to every other port (from the loop POV) again - including the original source port.

Since each loop partner is also included in the flooding, the broadcast continues to circulate through the loop in either loop direction, sending duplicates out of all switch ports on each cycle. That way, broadcast frames are accumulated until the loop bandwidth is exhausted. If all ports share the same bandwidth, extremely little productive traffic will be able to make it.

The usual countermeasure is to use a spanning tree protocol, removing the looping ports from the active network.

Another, cruder approach is to limit broadcast bandwidth. Since that drops productive broadcasts together with broadcast radiation, a loop will still cause network problems, only less violently so.

Since broadcast radiation also messes up the switch's MAC table - the circulating broadcast pulls the broadcast source MAC to the looping ports - a simple switch practically has no way to recognize what is happening. A more sophisticated switch could notice that the MAC is rapidly jumping across some ports. It could also be configured to shut down the looping ports when excessive broadcasts are detected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.