A network device experienced widespread traffic impact due to a Layer‑2 broadcast storm originating from a specific sub‑interface. Excessive broadcast and ARP traffic overwhelmed the forwarding plane (PFE), resulting in ARP resolution failures. As a consequence, multiple routes displayed next‑hop entries in a “hold” state within the forwarding table, leading to repeated BGP session flaps and service degradation.

Due to control‑plane instability, device access was maintained through the console for troubleshooting and recovery.

Traffic loss and service degradation across multiple prefixes.

show route forwarding-table destination displayed affected routes with next‑hop state set to “hold”.

ARP resolution failures observed across impacted interfaces.

Frequent BGP session flaps caused by unresolved next‑hop reachability.

Elevated CPU/PFE processing due to excessive ARP and broadcast packets.

Abnormally high broadcast counters on interface et‑0/0/0.XXX

Management access instability, requiring console access.

Packet capture and show evo-pfemand host pkt-stats indicated excessive ARP and broadcast traffic.

A broadcast storm originating from sub‑interface et‑0/0/0.XXX flooded the forwarding plane with broadcast and ARP traffic.

The excessive Layer‑2 traffic prevented timely ARP resolution, which directly affected next‑hop resolution for routed prefixes. This indirectly caused BGP instability, as unresolved next‑hops triggered repeated route withdrawals and re‑installations.

Resolution / Actions Taken

1. Validated Forwarding State

• Confirmed affected prefixes with next‑hop entries in “hold” state using:

show route forwarding-table destination

1. Identified Traffic Flood

• Reviewed PFE statistics and packet counters via:

show evo-pfemand host pkt-stats

• Observed excessive ARP and broadcast processing.

1. Isolated the Source

• Correlated firewall broadcast counters to interface et‑0/0/0.XXXX.
• Determined this sub‑interface as the source of the broadcast storm.

1. Mitigation

• Deactivated interface et‑0/0/0.XXXX to immediately stop the broadcast flood.

1. Validation

• Monitored system behavior post‑deactivation.
• Confirmed ARP resolution recovery.
• Verified next‑hop entries transitioned out of the “hold” state.
• Observed stable BGP sessions with no further flaps.

Preventive Measures / Detection Enhancement

A layer‑2 firewall filter was used to identify and rate‑limit broadcast, multicast, and ARP traffic, allowing rapid identification of the offending interface.

Firewall Filter Used

This filter enabled visibility into abnormal Layer‑2 traffic patterns and assisted in rapid fault isolation.

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE interface-specific

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 0.5 from destination-mac-address ff:ff:ff:ff:ff:ff/48

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 0.5 then accept

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 0.5 then count broadcast_count

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 0.5 then policer Policer_50K

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 1 from destination-mac-address 01:00:5e:00:00:00/25

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 1 from destination-mac-address 33:33:00:00:00:00/16

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 1 then accept

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 1 then count mcast_count

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 1 then policer Policer_50K

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 1.5 from ether-type arp

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 1.5 then accept

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 1.5 then count arp_count

set firewall family ethernet-switching filter L2_BCAST_MCAST_LIMIT_BRIDGE term 1.5 then policer Policer_50K