Broadcast radiation

From Wikipedia, the free encyclopedia

Broadcast radiation is the accumulation of broadcast and multicast traffic on a computer network.

The final stage of a broadcast radiation is called a broadcast storm and it is a state where new network connections cannot be established, and existing connections may be dropped , as the condition is now self-sustaining and magnifying.

Especially within a big broadcast domain a number of causes can generate a snowball effect chain reaction culminating with the broadcast storm with a severe negative impact on network latency.

Contents

[edit] Causes

Most comonly the cause is a redundant switched topology where two or more links exist betwen two switches and as broadcasts and multicasts are forwarded by switches out every port except the port that received the traffic the two switches will broadcast eachother's broadcasts creating a switching loop.


In some cases, a broadcast storm can be instigated for the purpose of a denial of service (DOS) using one of the magnification attacks smurf.c or fraggle.c , where smurf sends a large amount of ICMP Echo Requests (ping) traffic to a broadcast address, with each ICMP Echo packet containing the spoof source address of the victim host.

When the spoofed packet arrives at the destination network, all hosts on the network reply to the spoofed address. The initial Echo Request is multiplied by the number of hosts on the network. This generates a storm of replies to the victim host tying up network bandwidth, using up CPU resources or possibly crashing the victim.


In wireless networks a disassociation packet spoofed with the source to that of the AP and sent to the broadcast address can generate a disassociation broadcast DOS attack.

[edit] Prevention

  • Filtering broadcasts by layer 3 equipment , typically routers (and even switches that employ advanced filtering called brouters) .
  • Routers and firewalls can be configured to detect and prevent maliciously inducted broadcast storms with the magnification attacks.

[edit] Misinterpretations

  1. A common misinterpretation is that routing loops have anything to do with broadcast storms. Working at Layer 3, routers (unlike layer 2 equipment) do not forward MAC-level broadcast traffic.
  2. Another misinterpretation is that routers can not forward broadcasts under special circumstances. Some routable protocols support the use of internetwork-level broadcasts , if the router is configured to forward them the broadcast domain segmentation is compromised.
  3. Most commonly it is believed that only routers can impact the broadcast domain , or filter broadcasts , but as we seen switches can blur the layer line and do that with VLAN's and can do filtering (they still need a router for forwarding however).
  4. A misinterpretation is that a broadcast can be responded with a broadcast.This is not true , however a broadcast can be issued to gather information needed to respond to an initially received broadcast, and in a redundant looped topology this second broadcast can reach the interface that sent the initial broadcast.

[edit] MANET broadcast storms

In a mobile ad-hoc network (MANET), route request (RREQ) packets are usually broadcasted to discover new routes. These RREQ packets may cause broadcast storms and compete over the channel with data packets. One approach to alleviate the broadcast storm problem is to inhibit some hosts from rebroadcasting to reduce the redundancy, and thus contention and collision.

[edit] References

  1. Appendix E: Broadcasts in Switched LAN Internetworks [1] [2]PDF
  2. Defense Against the DoS/DDoS Attacks on Cisco Routers [3] [4]PDF
  3. Disassociation Broadcast Attack Using ESSID Jack [5]
  4. The Broadcast Storm Problem in a Mobile Ad Hoc Network [6]PDF
Retrieved from "http://en.wikipedia.org../../../b/r/o/Broadcast_radiation.html"