"Broadcast suppression" and recommendations

[Laetitia_LAR]

Hello

I ask myself the following question:
what is the value recommended for the command "broadcast-suppression" (in percentage or pps ? ).
I have the switches with 1Gbps ports for users, and 10Gbps for uplink to Core.

Is it a command to be applied to general way or occasionally to solve problems?

Thank you for your recommendations.

Laetitia.

[Apachez-]

Depends on if you expect to have plenty of broadcast traffic or not.

For a corporate net with many windows clients there can be plenty of actions taken through broadcast. Also depending on how many machines you will have per vlan.

Out of the blue I think these values should be ok, not to low and yet not to high:

broadcast-suppression pps 100

multicast-suppression pps 100

unicast-suppression pps 100

Note however that you of course shouldnt use multicast suppression if you use multicastbased routing protocols or have multicast traffic for other use (iptv or such)- or if you do you would most likely need a higher pps value than 100.

The unicast-suppression, if Im not mistaken, is regarding packets where the device doesnt have a match for in its arp table. This is also called DLF (Destination Lookup Failure) - in these cases the packet will be broadcasted on all interfaces which belongs to the same vlan except the interface the packet arrived at.

The point of unicast-suppression would be if a client gets a DDoS attack and disconnects - if you are unlucky the incoming traffic would then be "mirrored" to all the other clients in the same vlan in the same switch (and a unicast-suppression of pps 100 would limit this "mirrored" DDoS towards the other clients in the same vlan on the same switch).