Storm Control: One Port Floods the VLAN
One port is sending most of the broadcasts on the VLAN, and nothing on the switch limits it. Find it and cap it, live, right below.
Symptom
A looped desk switch floods VLAN 10 with broadcasts and the whole floor slows down. Find the port and add the limit that should have contained it.
Your mission
Inspect, recover, then verify
Format
Cisco IOS CLI
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: SW1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Create a free account to open Storm Control: One Port Floods the VLAN. You get the root cause and the full step-by-step fix.
No spam. The fix lands in your inbox too. Your account includes 5 guided labs free. After that, the Learning Pass unlocks every remaining lab.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
Every user in VLAN 10 on SW1 reports a slow network since this morning. A small unmanaged switch with a looped cable was found on a desk, but nobody knows which port it is on.
What you'll practice
- Spot a broadcast storm from interface counters
- Read show storm-control filter states
- Configure a rising and falling broadcast threshold
- Choose between the default filter action, trap and shutdown
The topology
SW1 serves VLAN 10 users on Gi1/0/1 to Gi1/0/24. Gi1/0/10 connects to the looped desk switch.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show interfaces GigabitEthernet1/0/10 countersshow storm-control GigabitEthernet1/0/10 broadcastshow running-config interface GigabitEthernet1/0/10Topology diagram
Fact-checked references
The commands and behaviour in this lab were checked against these primary references.
Frequently asked
What do the two numbers in storm-control broadcast level mean?
The first is the rising threshold, the level at which the port starts dropping that traffic type. The second, optional, is the falling threshold: forwarding resumes once traffic drops below it. Without it, both are the same value.
What does the port do by default when the limit is hit?
It drops the excess traffic of that type and keeps the port up. storm-control action trap adds an SNMP trap, and storm-control action shutdown err-disables the port instead.
Can I run this on the lab's virtual switches?
No. The virtual switch images used in our PNETLab labs reject storm-control, so this lab follows Cisco's Catalyst documentation for the commands and output instead.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.