Broadcast, Directed, or Storm?

About this interactive

Three terms, told apart by how broadcast traffic behaves. An ordinary broadcast is addressed to every host on the local segment, used by things like ARP and DHCP discovery, and it does not cross a router, so it stays inside the local network. A directed broadcast is aimed at the broadcast address of a different subnet: it travels across the routers as ordinary unicast and only fans out to every host once it reaches that subnet. That is the one with an attack use, because a spoofed source address makes all those hosts reply to the victim, a reflected amplification attack, which is why routers drop directed broadcasts by default. A broadcast storm is not an addressing choice at all. It is what happens when a switching loop, often from redundant links with loop prevention off, duplicates broadcast frames endlessly until they saturate the segment and performance collapses. The lesson notes it is usually an accident rather than an attack, but it is just as damaging. The defender's skill is reading which of the three a description is: local-only, aimed at a remote subnet, or looping out of control.

What you'll learn

Distinguish an ordinary broadcast, a directed broadcast, and a broadcast storm by how each behaves relative to the Layer 3 boundary
Recognise that a directed broadcast can be abused with a spoofed source to drive a reflected amplification attack

Aligned to

CompTIA Security+

2.4 Given a scenario, analyze indicators of malicious activity.

Key terms

Broadcast: A transmission type in which one device sends a single packet that is delivered to every other device on the local network segment simultaneously. Broadcast traffic is contained within a broadcast domain and does not cross router boundaries.
Directed Broadcast: A packet addressed to the broadcast address of a remote network that travels as unicast until reaching that network, then is delivered to all hosts on it.
Broadcast Storm: A network condition in which excessive broadcast traffic overwhelms switch resources, preventing normal communication from occurring.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.

Topics

Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →