A broadcast storm is a Layer 2 loop gone feral: with no loop protection, a broadcast frame circles the switched network forever, multiplying until links saturate and the whole segment grinds to a halt. Spanning Tree Protocol (STP) exists to prevent exactly this — so a storm usually means STP was bypassed, disabled, or a loop formed faster than it could react.
1. Recognise it
The signature is unmistakable: CPU on the switch pegged, every link light blinking in unison, and show interfaces counters showing broadcast/multicast rates climbing without limit. Connectivity is intermittent or gone across the whole VLAN, not just one host.
2. Break the loop
First stop the bleeding: physically or administratively shut the port that closed the loop (often a cable patched back into the same switch, or a rogue unmanaged switch). show spanning-tree shows which ports are forwarding vs blocking and whether a port is flapping between roles — the flapping one is your loop. Disabling it drops the storm immediately.
3. Find why STP didn't catch it
Common causes: STP disabled on a VLAN, a one-way link (unidirectional fault) that hid BPDUs, or an edge device that started forwarding before STP converged. show spanning-tree detail shows topology-change counts — a storm of changes points at a flapping link.
4. Prevent the next one
On access (edge) ports, enable PortFast so host ports skip the listening/learning delay, and pair it with BPDU Guard so that if anyone plugs a switch into a host port, the port shuts itself down instead of forming a loop. That combination — fast edge ports that disable themselves the instant they see a BPDU — is the standard defence.
Practise network incidents
Broadcast storms and other switch/router incidents appear in the simulator (they need the Network Diagnostics skill to reveal the hint). Work them in a full incident response shift, and see BGP troubleshooting and OSPF adjacency for the routing side.