A faulty device floods broadcast frames into an access VLAN, saturating links and switch CPUs. The team wants each access port to limit broadcast traffic to a set share of bandwidth and take an action when the threshold is exceeded. Which feature fits?
Select an answer to reveal the explanation.
Short Explanation
Storm control is a pressure valve on each port: once broadcast traffic passes the level you set, the valve kicks in. It doesn't care who sent the frames, only how much is pouring through. The trap is the rate limits on DHCP snooping and DAI, which only count their own packet types.
Full Explanation
Storm control monitors broadcast, multicast or unknown unicast traffic arriving on an interface over short intervals and compares it with a configured threshold, expressed as a percentage of bandwidth or as a bits-per-second or packets-per-second rate. When traffic exceeds the threshold, the switch drops the excess for that traffic type until it falls back, and can additionally shut down the port or send an SNMP trap, depending on the configured action. That directly limits a broadcast flood from a faulty device and contains its impact to the offending port. Port security limits the number of source MAC addresses a port accepts; a faulty device flooding broadcasts from one MAC never trips it. DHCP snooping's rate limit counts only DHCP packets on untrusted ports, typically to blunt starvation attacks; general broadcast frames are not counted. Dynamic ARP inspection rate-limits ARP packets on untrusted ports, which helps against ARP floods but ignores other broadcast traffic. Exam caveat: storm control can drop legitimate broadcast-heavy traffic if thresholds are too low, so baseline normal levels before setting them. Operational check: review the interface's storm control status and counters after configuring it, and confirm a generated broadcast burst above the threshold triggers the expected drop, trap or shutdown.