TechKnowSurge
TechKnowSurge Catalog Videos Directed Broadcasts and Broadcast Storm
VideoSecurityFree

Directed Broadcasts and Broadcast Storm

Broadcasts, directed broadcasts, and broadcast storms are fundamental networking concepts with direct implications for both network stability and security. Understanding how broadcast traffic behaves across network boundaries reveals how it can be exploited or unintentionally cause serious disruptions.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A broadcast is a network message addressed to all devices within a local area network simultaneously. Broadcast traffic is confined to its originating network segment and does not cross Layer 3 devices such as routers, meaning a broadcast generated on one network remains isolated from all others. At Layer 2, broadcast frames use a destination MAC address of all Fs, ensuring delivery to every device on the segment regardless of IP addressing. A directed broadcast works differently by allowing a device on one network to target the broadcast address of a remote network. The packet travels as a normal unicast transmission until it reaches the destination network, where it is then broadcast to all connected devices. This behavior can be weaponized in a reflected amplification attack, where an attacker spoofs a victim's IP address as the source, sends a directed broadcast to a remote network, and causes every device on that network to reply to the victim — multiplying traffic and overwhelming the target. Broadcast storms represent a separate but equally disruptive threat to network availability. They occur when a physical or logical loop exists within a switched network, causing broadcast frames to circulate and be duplicated without end. The resulting flood of traffic consumes available bandwidth and processing capacity across all affected devices, effectively taking the network offline. Broadcast storms are not always the result of a deliberate attack and can occur due to simple configuration errors or faulty cabling, but the impact on network operations is severe regardless of the cause. Spanning Tree Protocol exists specifically to prevent these loops from forming in production environments.

What you'll learn

What's covered

Broadcasts & Broadcast Storms

Key terms

Broadcast
A transmission type in which one device sends a single packet that is delivered to every other device on the local network segment simultaneously. Broadcast traffic is contained within a broadcast domain and does not cross router boundaries.
Directed Broadcast
A packet addressed to the broadcast address of a remote network that travels as unicast until reaching that network, then is delivered to all hosts on it.
Broadcast Storm
A network condition in which excessive broadcast traffic overwhelms switch resources, preventing normal communication from occurring.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Distributed Denial of Service
DDoS
An attack that uses multiple systems to flood a target with traffic, making it unavailable to legitimate users.
Router
A network device that forwards data packets between networks based on IP addresses.
Layer 3
The Network layer of the OSI model, responsible for logical addressing and routing packets between networks.

Topics

Networking Broadcast Traffic Directed Broadcasts Broadcast Storms Ip Spoofing Amplification Attacks

Transcript

Broadcasts

These are not necessarily terms that are associated with attacks. For instance, I have had broadcast storms on my networks that have been devastating and caused a lot of problems, but it was not from some attack that somebody was intentionally doing. However, it is something that an adversary could use, and we will certainly apply it to some of the attacks that we have.

Broadcasts are common within a local area network. What happens is that one machine maybe wants to address all the machines on the network, so it will send a broadcast out and it will reach all machines that are on that network. Broadcasts stay within the local area network, so a broadcast that is sent out in this network stays in this local area network. It does not traverse layer three devices. Same thing over here: we have got another local area network over here and it would not traverse this router. So it does not go past these routers.

Directed broadcasts

However, there is something called a directed broadcast. Essentially what we can do is ping the broadcast address of this network right here. What will happen is that it will traverse to get there just by unicast, but then when it gets to this network it will broadcast out to this network, and so we call it a directed broadcast.

Typically what you would see, if a machine on the network sent out a broadcast message to that network, is that it would have the address of 255.255.255.255. Really, all the forwarding that happens within this network is based off of the MAC address anyway, so it is not as critical, but there is an association between this and the MAC address, which is all Fs. So it gets sent out to all machines that would be on this network.

If we were going to do a directed broadcast, what we would do is send it to, let us say this address over here is 1 192.168.1.0 0/24, that is the network over here, so the broadcast address for this would be .255. What would be sent out is a message to 1 192.168.1.255, and this is where it would remain unicast until it got to this network, and then it would broadcast out onto this network to all devices on that network.

So you can see where we could actually leverage this with a reflected attack. What I could do is ping 1 192.168.1.255, and I could spoof it from maybe another machine right here, and I am spoofing this address right here. What would happen is it would get sent all the way into this network, and then all the devices on this network would reply to this spoofed address right here. Therefore we carry out an attack against this.

Broadcast storms

I will just mention broadcast storms also, because this can [ __ ] a network. If somewhere in here, let us say you had another switch plugged in here and that created a loop in here, what would happen is that anything that gets broadcast out would be duplicated, and it would just be this never-ending loop of duplicate information. So a broadcast within this network that has a loop like this could create a broadcast storm. And let me tell you, it will [ __ ] a network.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →