6

Within a typical service provider environment I can see how broadcast and multicast storm control can be useful. I am confused regarding unicast storm control though.

Reading the Cisco docs online they give examples such as protecting against port flooding if the destination MAC of an incoming frame isn't in the CAM tables. This makes good sense to me. So does storm-control unicast only measure the pps rate (or bps rate) of frames that are for destinations not in the CAM tables, or all destinations that aren't a broadcast or multicast address (so just the total number of unicast frames)?

I'm worried that configuring such a feature could shut a port down that shouldn't be shut down simply because it has a high pps rate. An example of this is ports with voice services attached that have high frame rates but are low bpp rates of unicast frames.

Is this feature only measuring the frame/packet rate of unknown destination addresses or all unicast frames, what are the dangers here?

1
  • confirming storm-control unicast is all unicast. be warned.
    – user13912
    Feb 16, 2015 at 16:12

1 Answer 1

9

So does storm-control unicast only measure the pps rate (or bps rate) of frames that are for destinations not in the CAM tables, or all destinations that aren't a broadcast or multicast address (so just the total number of unicast frames)?

I have to confess that I mistakenly trusted the Nexus doc below which said only unknown unicast is rate-limited; however, that's definitely wrong for Cisco IOS. The reality is (at least on IOS platforms) that unicast storm control affects all unicast traffic; the Cisco Nexus doc I quoted said it only affected traffic that was unknown unicast. I will endeavor to test on Nexus at a later date.

In an effort to atone for my mistake, I built a quick screencast of what happens when I:

  • Configure a Cisco IOS switch with unicast storm-control to throttle at 1Mbps.
  • Use speedtest_cli.py to start a unicast download from speedtest.net
  • Reconfigure the switch without unicast storm control
  • Download from speedtest.net again...

Hit your refresh button to restart the screencast at the beginning

storm-control screencast

Bottom line

  • Unicast storm-control affects all unicast traffic in Cisco IOS
  • Unicast storm-control is applied on traffic inbound to the switchport

My Original quote from the Nexus docs, which I applied to the OP's Cisco 2960

Quoting the Nexus Storm Control Docs (emphasis mine):

"You can use the traffic storm control feature to prevent disruptions on Layer 2 ports by a broadcast, multicast, or unknown unicast traffic storm on physical interfaces. "

Storm control operates the same way across Cisco platforms; if the destination-mac-address is not in the CAM table, then then the switch must flood it out all ports in the Vlan (except the one it came in on). Suffient quantities of this kind of traffic would trigger your Unicast Storm Control thresholds.

2
  • Thanks for the prompt response Mike and the info on the ARP & CAM timers. That is pretty clear really, the problem I was having is that there seems to be little to no new 2960 documentation which is the switches I have in mind and it doesn't say "unknown unicast" just "unicast".
    – Baldrick
    Dec 6, 2013 at 15:55
  • 2
    I just tested this and found that Cisco also counts the standard unicast packets towards the storm. Meaning that a simple file copy causes the storm-control to kick in. Running IOS 15.2(2)E. Just be aware that storm-control unicast may come back to bite you.
    – Brain2000
    Jan 29, 2015 at 17:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.