I recently switched jobs. By the time I left my last job our network was three years old and had been planned very well (in my opinion). Our address range was split down into a bunch of VLANs with the largest subnet a /22 range. It was textbook.

The company I now work for has built up their network over about 20 years. It's quite large, reaches multiple sites, and has an eclectic mix of devices. This organisation only uses VLANs for very specific things. I only know of one usage of VLANs so far and that is the SAN which also crosses a site boundary.

I'm not a network engineer, I'm a support technician. But occasionally I have to do some network traces for debugging problems and I'm astounded by the quantity of broadcast traffic I see. The largest network is a straight Class B network, so it uses a /16 mask. Of course if that were filled with devices the network would likely grind to a halt. I think there are probably 2000+ physical and virtual devices currently using that subnet, but it (mostly) seems to work. This practise seems to go against everything I've been taught.

My question is:

In your opinion and  From my perspective - What measurement of which metric would tell me that there is too much broadcast traffic bouncing about the network? And what are the tell-tale signs that you are perhaps treading on thin ice?

The way I see it, there are more and more devices being added and that can only mean more broadcast traffic, so there must be a threshold. Would things just get slower and slower, or would the effects be more subtle than that?

  • There are still some areas using 100mb switching, too. – john Nov 5 '12 at 21:26
  • How many switches do you have a network that large? Are you sure you aren't reaching the maximum limit of spanning tree? See this write up of a hospital network that grew too large, and seriously failed. cio.com.au/article/65115/all_systems_down – Zoredache Nov 6 '12 at 0:31
  • Thanks for this, it makes an interesting read. I think something similar has happened before but measures have been taken to stop it from happening again(i.e. switchport config). – john Nov 6 '12 at 8:22
  • My humble opinion: Broadcast domain size is not nearly as important today as it was many decades ago. When we had Token Ring, and Bridges, and Spanning Tree... Then YES it was a big deal. Today I am running Gigabit, all Switched, Routers, no Spanning Tree - and I have several sites with 252.0 mask, more than 800 actual host machines plus all the other network junk like printers and such. These sites are running FLAWLESSLY.... There is no longer an issue about the domain size in a modern network. (BTW: I have a Class B IP subnet and had to carve it up into 50 different size pieces over 25 year – user272367 Feb 19 '15 at 20:54
  • @RobKorn - No spanning tree?? – john Mar 4 '15 at 12:02

There's nothing -inherently- wrong with a large broadcast domain if it's appropriately (and safely) configured. Employing PVLAN's, for example, can allow for very large networks without too much drama as isolated hosts don't see traffic from one another. Similarly if the network is relatively static, the links very stable and controls are in place to block broadcast/multicast/unicast flooding then it can be made to work.

That said, more often than not the sort of networks you're describing (2000+ hosts) are basically a crisis waiting to happen. Some of the issues/warning signs might include-

Excessive broadcast traffic - Either app traffic being blasted everywhere (i.e. like old school Windows), excessive ARP traffic, etc. Think of this in terms of packets per second moreso than absolute bandwidth - hundreds of packets per second of background traffic is getting up there. Bear in mind that certain network events (switches coming up or down) may exacerbate this terribly.

Network diameter / topological stability - Do transitory spanning tree loops occur under certain conditions (i.e. device reboot)? What volume of TCN's and so forth are you seeing? Is the root bridge moving around at all? Physically how many switches are cascaded together?

How do link failures work? If a link drops, what happens? I've seen situations where things were badly broken to the point where the network topology would literally never stabilize when a redundant link came down. It required mass reboots - well, more properly, it required a complete redesign, but that's a separate issue.

Interface drops on routers and switches? Buffer issues? These can also be hints.

In general bridges that cross physical sites cause a disproportionate amount of trouble. Is there a compelling reason why your sites (or floors) couldn't be broken up into routed subnets? Best practice is certainly to route were possible and bridge where not...

  • Thanks for your input. I thought there might be far too many complicating factors to give a definitive answer. We have periodical slow-downs in certain areas and some weird issues with links becoming active, despite the ports being configured as edge ports (so I'm told). I agree with you entirely, but unfortunately I'm not in an influential position. – john Nov 9 '12 at 13:56
  • Document your issues thoroughly and make suggestions for improvement. When (and it -is- a when, not an if) the setup craters you'll be on record with a solution. This is likely the best you can do, from the sound of things. – rnxrx Nov 9 '12 at 19:07

"In your opinion and from my perspective" ... opinion and facts (which this site is based on) mix quite badly.

Yes, with more broadcasts things get slower. But with modern networks (switches rather than hubs and gigabit speeds) using more than a full /24 should not be a problem. Even /22 should be fine.

A lot depends on your your applications and protocols. E.g. I would not fear an average office with network drives and up to 2000 computers and printers.

2b) Cisco seems to disagree with this. :) But then again cisco teaches how class A, B and C networks work. Which should only be thought in history lessons. Not in current network management lessons. :)

  • Thanks for the tip on opinions. Everyone has their own view on why they think a particular choice might be more suitable than others, but in this case I can see why there might be a concrete answer. You haven't really answered the question, though. – john Nov 5 '12 at 21:20
  • Ok. Lets try this brief one. "Will a large network full of decides result in some slowdown?" With the answer "yes". Is that 'some' significant? Only if your network is busy enough that the larger number of broadcasts slow things down (e.g if it is on average less then 80% busy then I would not worry). – Hennes Nov 5 '12 at 21:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.