GSEC · Question #54
Which of the following is a Layer 3 device that will typically drop directed broadcast traffic?
The correct answer is C. Routers. Routers are the Layer 3 devices that block directed broadcast traffic by default, a behavior standardized by RFC 2644 to prevent smurf amplification attacks.
Question
Which of the following is a Layer 3 device that will typically drop directed broadcast traffic?
Options
- AHubs
- BBridges
- CRouters
- DSwitches
How the community answered
(51 responses)- A4% (2)
- B10% (5)
- C82% (42)
- D4% (2)
Why each option
Routers are the Layer 3 devices that block directed broadcast traffic by default, a behavior standardized by RFC 2644 to prevent smurf amplification attacks.
Hubs are Layer 1 (Physical layer) devices that repeat electrical signals to all ports without inspecting any packet headers and have no ability to filter IP broadcast traffic.
Bridges are Layer 2 (Data Link layer) devices that forward frames based on MAC addresses and cannot inspect or filter Layer 3 IP directed broadcast addresses.
Routers operate at Layer 3 (Network layer) and inspect IP headers, which allows them to identify and drop directed broadcast packets (those addressed to a subnet's broadcast address). RFC 2644 updated the default router behavior to discard directed broadcasts rather than forward them, preventing smurf-style DDoS amplification. Layer 1 and Layer 2 devices lack IP header awareness and cannot make this filtering decision.
Switches are primarily Layer 2 devices that make forwarding decisions based on MAC address tables and do not inspect IP headers to filter directed broadcasts by default.
Concept tested: Router directed broadcast filtering at Layer 3
Source: https://www.rfc-editor.org/rfc/rfc2644
Topics
Community Discussion
No community discussion yet for this question.