9

I'm not sure what is the difference in behaviour between switchport block multicast and storm-control multicast and I don't think cisco elaborates the difference very well in their documentation, other than the fact storm-control grants you levels of control, but for this case, suppose the storm-control only lets you pick up 0 or 100. How is it any different from switchport block, for instance?

Update: I accidentally wrote "switchport block unicast" when I intended to write "switchport block multicast".

Ron Maupin
  • 98,218
  • 26
  • 115
  • 191
CaseyJones
  • 327
  • 2
  • 10

1 Answers1

12

Well the first difference would be that switchport block unicast blocks unknown unicast and storm-control multicast blocks multicast packets.

The difference between switchport block XXXcast and storm-control XXXcast is exactly what you want to exclude in your question. You can pick any percent value for storm-control. It will block traffic of the specified type which exceeds this percentage of bandwidth on the port. switchport block is a simple yes/no. It blocks everything when activated.

Update:

As ytti mentioned, on some low-end boxes when storm-control multicast is exceeded all traffic will get filtered. In that case storm-control multicast is dangerous and useless.

Also on high-bandwidth interfaces (1/10GE) please remember that even a small percentage of the bandwidth can kill a box that punts the packets to the CPU. If possible use CoPP to protect the control plane. Also always use pps instead of bps for CoPP if possible.

Sebastian Wiesinger
  • 8,107
  • 3
  • 34
  • 60
  • 4
    Some low-end switches, like 3550 when 'storm-control multicast' is exceeded all traffic is filtered, not just multicast, which makes it highly unusable. Also when I see people configuring storm-control broadcast I regularly see them setting ridiculously large values, WS-X6704-10GE minimum possible value 0.34% is higher than you want (box will die for 0.34% @ 10GE). – ytti Aug 09 '13 at 10:40
  • hmm 34MBit/s are probably enough, yes. CoPP could perhaps help in that case. – Sebastian Wiesinger Aug 09 '13 at 12:17
  • 2
    That reminds me, when platform allows doing storm-control or CoPP in pps, always use pps instead of bps. – ytti Aug 09 '13 at 12:20
  • Thanks, I accidentally mistyped my question, but your answer was clever enough to cover what I wanted to know. I have 2 questions, out of your explanation: 1. What is considered an "unknown *cast" 2. Why can it kill the box? – CaseyJones Aug 09 '13 at 13:16
  • 1
    1) There is only 'unknown unicast'. It means that the switch/router does not know on which port the destination MAC address is and so it floods the packet to all ports (except the one where he received it from). – Sebastian Wiesinger Aug 09 '13 at 13:41
  • 1
    2) Because the CPU has to look at every packet it receives and that can take a lot of CPU time. The CPU is also needed for other stuff like keeping all the control protocols running (STP, LACP, BGP, IGPs...) it can't do that if it's overwhelmed with "useless" packets. Various features on the switch (e.g. IGMP snooping) will punt packets to the CPU. This is not a problem with unknown unicast but with multicast and perhaps broadcast traffic. – Sebastian Wiesinger Aug 09 '13 at 13:51