L2VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Traffic storm control

Updated: June 15, 2026

Want to summarize with AI?

Log in

Details traffic storm control features, covering operational behavior, supported traffic types, restrictions, configuration procedures, and process flows for mitigating excessive traffic in VPLS environments.

A traffic storm control feature is a bridge-port traffic suppression feature that

  • monitors incoming traffic levels over a one-second hardware interval

  • drops traffic when it reaches configured thresholds, and

  • helps prevent excess traffic from disrupting the VPLS bridge.

Table 1. Feature history table

Feature Name

Release Information

Feature Description

Traffic Storm Control

Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100]) (select variants only*)

*The traffic storm control functionality is now extended:

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-D/A

Traffic Storm Control

Release 25.1.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on Cisco 8011-4G24Y4H-I routers.

Traffic Storm Control

Release 24.4.1

Introduced in this release on: Fixed Systems (8700) (select variants only*)

*The traffic storm control functionality is now extended to the Cisco 8712-MOD-M routers.

Traffic Storm Control

Release 24.3.1

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100])(select variants only*); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])(select variants only*)

*The traffic storm control functionality is now extended:

  • 8212-48FH-M

  • 8711-32FH-M

  • 88-LC1-52Y8H-EM

  • 88-LC1-12TH24FH-E

Traffic Storm Control

Release 24.2.11

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]) (select variants only*)

*The traffic storm control functionality is now extended to routers with the 88-LC1-36EH line cards.

Traffic Storm Control

 Release 7.3.2

This feature monitors incoming traffic levels on a port in the VPLS bridge. It drops traffic when the number of packets reaches the configured threshold level, thus preventing packets from flooding the VPLS bridge and creating excessive traffic and degrading network performance.

Storm control on a VPLS bridge

Storm control protects a VPLS bridge from excessive Layer 2 traffic on an access circuit (AC). When multiple hosts or routers connect to the same LAN, protocol traffic rates can increase, creating security risks and potential disruptions. Packet floods to a VPLS bridge may degrade network performance and disrupt bridge operation—this condition is known as a traffic storm.

Storm control suppresses traffic when packet levels reach configured threshold values. This helps prevent disruption of the VPLS bridge and enhances Layer 2 port security.

Key details include:

  • Storm control limits excessive traffic on an AC under a VPLS bridge.

  • Configurable threshold levels determine when traffic suppression begins.

  • Separate threshold levels can be set for different traffic types.

  • The feature helps reduce traffic storms and protect network performance.

  • Use the storm-control command to enable storm control on the VPLS bridge.

Supported traffic types

On each VPLS bridge port, both packet-per-second and bits-per-second rate are supported. You can configure up to three storm control thresholds, one for each supported traffic type. If you do not configure a threshold for a traffic type, storm control is not enabled on that port for that traffic type.

  • Broadcast traffic: Packets with a destination MAC address equal to FFFF.FFFF.FFFF.

  • Multicast traffic: Packets with a destination MAC address not equal to the broadcast address, but with the multicast bit set to 1.

  • Unknown unicast traffic: Packets with a destination MAC address not yet learned.

How traffic storm control works

A traffic storm occurs when excessive packet flooding on a LAN increases protocol traffic and degrades network performance. Traffic storm control helps protect the VPLS bridge and provides Layer 2 port security on the access circuit.

Summary

The key components involved in traffic storm control are:

  • The ingress port: Receives the incoming traffic that the router monitors.

  • The router: Measures the traffic level against the configured storm-control threshold.

  • The storm-control threshold: Defines the allowed traffic rate for the configured traffic type on the bridge port.

Traffic storm control evaluates incoming traffic continuously and enforces the configured limit during each monitoring interval.

Workflow

Traffic storm control involves these stages:

  1. The router monitors incoming traffic levels on a port during a fixed one-second hardware interval.
  2. During that interval, the router compares the measured traffic level with the storm-control threshold configured for the bridge port and traffic type.
  3. When the incoming traffic reaches the configured threshold, the router drops traffic of that type until the end of the current interval.
  4. At the beginning of the next interval, the router allows traffic of the specified type again and repeats the monitoring cycle.

Result

Traffic storm control limits excess traffic on the bridge port and helps prevent a traffic storm from disrupting the VPLS bridge.

Feature behavior for traffic storm control

  • Storm control configuration is allowed at the bridge port level.

  • Configuration on a Layer 2 subinterface applies to the main interface as well.

  • Policer is applied to the main port. Thus, policing applies to all subinterfaces that are within a bridging service.

  • When multiple subinterfaces of a common Ethernet port have storm control configured, only one subinterface is used for storm control configuration. Usually, the first subinterface that is added is picked up.

  • Storm control has little impact on router performance. Packets passing through ports are counted regardless of whether the feature is enabled. Additional counting occurs only for the drop counters, which monitor dropped packets. Storm control counts the number of packets dropped per port. The drop counters are cumulative for all traffic types.

  • When applied to a bundle AC, policing occurs independently on each main port that is a member of the bundle. Aggregate BUM traffic can be up to the configured rate times the number of bundle members.

Restrictions for traffic storm control

Traffic storm control is subject to important restrictions to ensure predictable and supported bridging behavior. Follow these requirements:

  • Use traffic storm control only on supported bridge-port configurations.

  • Storm control supports main ports only.

  • Storm control configuration operates at the bridge-port level, not the bridge-domain level.

  • Storm control does not support pseudowire-level operations.

  • Storm control does not support QoS input policy.

  • Do not assume the hardware applies the exact configured rate.

  • Storm control converts packets-per-second (PPS) configurations to a kbps value, assuming a 256-byte packet size.

  • When you configure the storm control rate at the attachment circuit level, hardware rate limiter values may deviate by up to five percent from the configured value.

Configure traffic storm control

Enable and verify storm control on bridge-domain attachment circuits to manage broadcast traffic and observe drop statistics.

Storm control is disabled by default on attachment circuits and must be explicitly enabled for each traffic type. Storm control statistics are only available on line cards based on Q200 silicon.

Before you begin

Follow these steps to configure storm control on the attachment circuit:

Procedure

1.

Configure storm control on the attachment circuit.

Example:

Router# configure
Router(config)# l2vpn
Router(config-l2vpn)# bridge group BG1
Router(config-l2vpn-bg)# bridge-domain BD1
Router(config-l2vpn-bg-bd)# interface HundredGigE0/0/0/0
Router(config-l2vpn-bg-bd-ac)# storm-control broadcast kbps 4500
Router(config-l2vpn-bg-bd-ac)# commit
2.

Review the running configuration.

Example:

configure
 l2vpn
  bridge group BG1
   bridge-domain BD1
    interface HundredGigE0/0/0/0
     storm-control broadcast kbps 4500
   !
3.

Review the source storm-control statistics guidance.

Example:

Storm control statistics are present as part of the AC bridging statistics only on the AC where storm control is configured.
The storm control statistics are the aggregate drop statistics across all ACs that share the same main port.

Storm control statistics are not available on Line Card based on Q100 Silicon.

Storm control is successfully configured on the bridge-domain attachment circuit, and you can verify drop statistics if using a Q200 silicon line card.