1

I'm focusing currently on the "Unknown Unicast Flooding", and the proposed solutions from Cisco.

I really need deep information about:

  • Cisco Blocking Unknown Unicast Flooding (UUFB)
  • Unknown Unicast Flood Rate-limiting (UUFRL)
  • Port Unicast and Multicast Flood Blocking
  • Unknown Unicast Forwarding (from Juniper)

I have already the concept they are used to block/limit unicast flooding attacks, however I'm intrested on how they work, the algorithms behind the process, any specific RFC, mechanisms and approaches !

I search about those concept, but what I found is just how configure them without go deep in their algorithms.

Yours sincerely,

3
  • Please, notice that I'm not trying to understand the role of the proposed solutions from Cisco or Juniper, I need to understand the algorithm, the process behind the approach, which mechanisms are used ?, for example, one for Cisco solution is based on "A Two Rate Three Color Marker", RFC2698. For this, I need to go in depth with other solutions (in term of algorithm).
    – Bouba
    Nov 30 '15 at 23:16
  • Why do you need to know the exact algorithm? Most vendors don't necessarily discuss that because they may want to change it later. You may or may not get someone at Cisco to go into more depth than, "Traffic storm control monitors the level of each traffic type for which you enable traffic storm control in 1-second traffic storm control intervals. Within an interval, when the ingress traffic for which traffic storm control is enabled reaches the traffic storm control level that is configured on the port, traffic storm control drops the traffic until the traffic storm control interval ends."
    – Ron Maupin
    Nov 30 '15 at 23:30
  • First of all, knowing how to configure some feature and understanding how the process behind that configuration works are not the same; if it’s the same, it won’t be a technical field and research field. Moreover, to develop new features and propose new approaches, it’s totally important to understand how the current solutions work (my current case).
    – Bouba
    Dec 3 '15 at 17:23
2

There really isn't a lot to this subject, you can block unknown unicasts or you can rate limit them to a particular percentage of the bandwidth. Juniper does have an interesting third option, but I'm not sure how useful it really is. There are no RFCs, each vendor is able to handle (or not) this subject in a different, possibly proprietary, way.

The Cisco configuration documents are usually pretty good about explaining how things work.

For how Cisco Cisco UUFB and UUMB works: Configuring Unknown Unicast Flood Blocking (UUFB)

By default, unknown unicast and multicast traffic is flooded to all Layer 2 ports in a VLAN. You can prevent this behavior by using the UUFB and UMFB features to prevent or limit this traffic. The UUFB and UMFB features block unknown unicast and multicast traffic flooding at a specific port, only permitting egress traffic with MAC addresses that are known to exist on the port. The UUFB and UMFB features are supported on all ports that are configured with the switchport command, including private VLAN (PVLAN) ports.

For how Cisco UUFRL works: Configuring Traffic-Storm Control

Traffic storm control (also called traffic suppression) monitors incoming traffic levels over a 1-second traffic storm control interval and, during the interval, compares the traffic level with the traffic storm control level that you configure. The traffic storm control level is a percentage of the total available bandwidth of the port. Each port has a single traffic storm control level that is used for all types of traffic (broadcast, multicast, and unicast).

Note •The router supports multicast and unicast traffic storm control only on Gigabit Ethernet LAN ports.

•The router supports broadcast traffic storm control on all LAN ports.

•Traffic storm control does not suppress spanning tree packets. Except for spanning tree packets, traffic storm control does not differentiate between control traffic and data traffic.

Traffic storm control monitors the level of each traffic type for which you enable traffic storm control in 1-second traffic storm control intervals. Within an interval, when the ingress traffic for which traffic storm control is enabled reaches the traffic storm control level that is configured on the port, traffic storm control drops the traffic until the traffic storm control interval ends.

Juniper has similar UUFB and UUFRL, but it also has a feature which allows a VLAN to forward all unknown unicast frames to a specific port (trunk), and each VLAN can use a different port in order avoid overloading a particular trunk: Understanding Unknown Unicast Forwarding

To prevent a storm, you can disable the flooding of unknown unicast packets to all VLAN interfaces by configuring one VLAN or all VLANs to forward all unknown unicast traffic to a specific interface. This channels the unknown unicast traffic to a single interface.

2

Simply put, Unicast Flooding is a the layer-2 process where by traffic with a destination to an unknown location is sent to every port (other than the receiving port.) This is due to the switch's mac-address-table not holding a port for the destination MAC -- it hasn't seen traffic from that MAC, the table is full, or the table is OFF. (few switches support disabling mac-learning.) Disabling unicast flooding is a very bad idea.

When talking about Multicast, it's a similar process but based on groups/IGMP snooping/etc. to know what traffic is wanted where. When the switch doesn't know to which ports a group belongs, it can flood it to all ports, or drop it entirely. Which is best for a network depends on the specifics of that network.

2

You must first understand where unicast flooding is coming from:

when a router wants to forward a packet to a destination, it must know the next hop port, IP address and MAC address. To know that it will use ARP protocol, that will update internal MAC/IP arp table.

To forward some traffic, a switch with listen to it's ingress ports and record source MAC addresses and put it in a MAC/port table. To switch a frame correcly, the switch must find the MAC address in the table. (if I have seen incoming traffic from MAC A on port 1, then MAC A is on port 1, I can remember it for some time).

Most equipments are both switch and routers those days. In certain case, the switch part can 'forget' the MAC/port relation, whereas the router knows the IP/MAC address.

In this case the packet is broadcasted to the whole VLAN, by the switch part (that would behave like a hub, flooding the frame to each ports but the incoming one).

UUFB will prevent the flooding and drop the packet in this case. UUFRL will flood but the flood will be rate limited. In both case you prevent/limit the flood but lose packets.

The documentation can be found online.

I would suggest having small networks and reduce ARP timers so that unicast flooding won't occur at all old documentation but the idea is still the same

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .