Sharing one of possible remedy to tackle broadcast and multicast storm in Internet Exchange environment. Feel free to share your experience.

2. The impact of broadcast and
multicast storm in IX
 High broadcast and multicast traffic to other participants
inside IX
 High CPU in line cards
 Resulting in unreachability between participants
 Affecting all BGP sessions
 At the end crippling the IX platform

3. The possible remedy…
 Testing has been done to simulate the storm
 Join traffic generator into the testing IX
 Inject 200K pps of broadcast, multicast, and unicast traffic
(Total is 600K pps traffic)
 Join 2 other participants into the testing IX and run BGP
between them
 Recommendation by Brocade to implement inbound L2
ACL rate-limit does not work
 Implement outbound L2 rate-limit instead!!
 High CPU in line card is still detected
 However testing participants inside IX can reach each
other
 BGP sessions inside testing IX are not affected

4. The possible remedy…

5. Sample traffic pattern during the
attack

6. Top L2 broadcast flow during the
attack

7. Top L2 multicast flow during the
attack

8. Outbound traffic capture to other
participant without outbound ACL

9. Outbound traffic capture to other
participant with outbound ACL

10. Thank you for the attention
For sharing/question:
jhalim10@gmail.com