Protecting Layer 2
IGMP snooping is a mechanism that we configure on a switch to minimize the impact of multicast traffic being directed to devices that are not interested in receiving it. This feature helps protect not only the infrastructure resources, but the devices that are attached to the network. Another feature that is well worth mentioning and will help to ensure the successful operation of your network is storm control.
Storm Control
Data storms in networks can be generated in several different ways, including an intentional denial of service (DoS) attack, a defective network interface card (NIC), a poorly programmed NIC driver, and so on. In order to prevent broadcast, multicast, or even unicast traffic from overwhelming a switch by an inordinate amount of traffic, the storm control feature offers the capability to set thresholds for these types of traffic on a per-port basis.
Configuration options are on a port basis and offer the capability to specify traffic based on the percentage of bandwidth, bits per second (BPS) or packets per second (PPS). If the threshold is reached, you can either send a Simple Network Management Protocol (SNMP) trap message or shut down the port by placing it in an error-disable state. The configuration parameters are as follows:
storm-control broadcast level <0.00 - 100.00> / bps / pps
storm-control multicast level <0.00 - 100.00> / bps / pps
storm-control unicast level <0.00 - 100.00> / bps / pps
storm-control action trap
storm-control action shutdown
In the following example, the switch will be configured to send a SNMP message when the broadcast level exceeds 50 percent:
Switch(config)#interface gigabitEthernet 0/2
Switch(config-if)#storm-control broadcast level 50
Switch(config-if)#storm-control action trap
The following is the SNMP message generated when the broadcast level has been exceeded:
%STORM_CONTROL-3-FILTERED: A Broadcast storm detected on Gi0/2. A packet filter
action has been applied on the interface.
You also have the ability to place the port in an error-disable state using the following command:
Switch(config-if)#storm-control action shutdown
The following output depicts the messages shown in the event of a port shutdown:
%PM-4-ERR_DISABLE: storm-control error detected on Gi0/2, putting Gi0/2 in
err-disable state
%STORM_CONTROL-3-SHUTDOWN: A packet storm was detected on Gi0/2. The interface has
been disabled.
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/2, changed state
to down
%LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to down
We mentioned DoS attacks earlier in this section. When configuring the storm-control action shutdown command, you may have to manually enable the ports in the event the port is disabled. Using the errdisable recovery commands helps to mitigate that problem:
Switch(config)#errdisable recovery cause storm-control
Swtich(config)#errdisable recovery interval 30
The following output shows the logging message after recovery:
2d07h: %PM-4-ERR_RECOVER: Attempting to recover from storm-control err-disable
state on Gi0/2
2d07h: %LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to up
2d07h: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/2, changed
state to up