By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

Broadcast Address

The broadcast address is a special IP address used to send a message to all devices on a network simultaneously. Understanding broadcast addresses is crucial for network troubleshooting, DHCP operations, ARP requests, and even certain network attacks. In penetration testing, broadcast traffic can reveal network topology, active hosts, and misconfigurations.

What You'll Learn

  • What broadcast addresses are and how they work
  • Calculating broadcast addresses
  • Types of broadcasts (limited vs directed)
  • Broadcast domains and their boundaries
  • Broadcast protocols (ARP, DHCP, NetBIOS)
  • Security implications of broadcast traffic
  • Broadcast storms and mitigation
  • Tools for analyzing broadcast traffic

What Is a Broadcast Address?

A broadcast address is an IP address that allows information to be sent to all devices on a specific network simultaneously.

The Analogy:

Unicast   = Direct mail to one address
Multicast = Mail to a specific group
Broadcast = Loudspeaker announcement to EVERYONE

Visual:

Regular (Unicast) Communication:
   Sender → Receiver
   192.168.1.10 → 192.168.1.20

Broadcast Communication:
                    ┌→ 192.168.1.5
   Sender    ───────┼→ 192.168.1.10
   (192.168.1.1)    ├→ 192.168.1.20
                    ├→ 192.168.1.50
                    └→ All devices!

How Broadcast Addresses Work

Network Structure:

Every network has:

  1. Network Address: First address (all host bits = 0)
  2. Broadcast Address: Last address (all host bits = 1)
  3. Usable Host Addresses: Everything in between

Example: 192.168.1.0/24

Network address:    192.168.1.0
First usable host:  192.168.1.1
Last usable host:   192.168.1.254
Broadcast address:  192.168.1.255
                    └─ All host bits set to 1

Binary View:

IP: 192.168.1.0/24
Subnet mask: 255.255.255.0

Network address (all host bits = 0):
11000000.10101000.00000001.00000000 = 192.168.1.0

Broadcast address (all host bits = 1):
11000000.10101000.00000001.11111111 = 192.168.1.255

Calculating Broadcast Addresses

Method 1: Binary Conversion

Steps:

  1. Convert IP and subnet mask to binary
  2. Find network portion (subnet mask 1s)
  3. Set all host bits (subnet mask 0s) to 1

Example: 10.20.30.40/24

IP:          00001010.00010100.00011110.00101000
Subnet mask: 11111111.11111111.11111111.00000000
             └────── Network ─────┘└─ Host ─┘

Set host bits to 1:
             00001010.00010100.00011110.11111111

Broadcast:   10.20.30.255

Method 2: Subtract and Add

Formula:

Broadcast = Network address + (2^host_bits - 1)

Example: 172.16.5.0/22

/22 = 32 - 22 = 10 host bits
2^10 = 1024 addresses
1024 - 1 = 1023

Network: 172.16.4.0 (align to /22 boundary)
Broadcast: 172.16.4.0 + 1023 = 172.16.7.255

Method 3: Wildcard Mask

Wildcard mask = Inverse of subnet mask

Subnet mask:  255.255.255.0
Wildcard:     0.0.0.255

Network + Wildcard = Broadcast
192.168.1.0 + 0.0.0.255 = 192.168.1.255

Quick Examples:

Network              Subnet Mask        Broadcast
──────────────────────────────────────────────────────
192.168.1.0/24       255.255.255.0      192.168.1.255
10.0.0.0/8           255.0.0.0          10.255.255.255
172.16.0.0/16        255.255.0.0        172.16.255.255
192.168.0.0/23       255.255.254.0      192.168.1.255
10.10.10.128/25      255.255.255.128    10.10.10.255

Types of Broadcasts

1. Limited Broadcast (255.255.255.255)

Destination: All devices on the local network only

Destination IP: 255.255.255.255
Scope: Local network only
Routers: Do NOT forward

Use cases:

  • DHCP Discover (client has no IP yet)
  • Initial network configuration
  • Local announcements

Example:

# DHCP Discover packet
Source: 0.0.0.0
Destination: 255.255.255.255
Message: "I need an IP address!"

2. Directed Broadcast

Destination: All devices on a specific remote network

Example: 192.168.5.255
Scope: All hosts in 192.168.5.0/24
Routers: Can forward (usually disabled)

Security note: Often disabled because of DDoS attacks (Smurf attack)

Example:

Attacker spoofs source IP
Sends ICMP echo request to 192.168.5.255
All hosts respond to spoofed victim IP
Victim gets flooded → DDoS

Broadcast Domains

A broadcast domain is the network area where broadcasts can reach.

Boundaries:

Layer 2 (Switches):
┌─────────────────────────────────┐
│    Broadcast Domain             │
│                                 │
│  Switch ─┬─ PC1                │
│          ├─ PC2                │
│          └─ PC3                │
│                                 │
│  All PCs receive broadcasts     │
└─────────────────────────────────┘

Layer 3 (Routers):
Broadcast Domain 1    Router    Broadcast Domain 2
┌──────────────┐       │       ┌──────────────┐
│ 192.168.1.0  │───────┼───────│ 192.168.2.0  │
│   /24        │       │       │   /24        │
└──────────────┘       │       └──────────────┘
   Broadcast stops at router

Key Points:

  • Switches: Forward broadcasts (same broadcast domain)
  • Routers: Block broadcasts (separate broadcast domains)
  • VLANs: Create separate broadcast domains on same switch

Protocols Using Broadcast

1. ARP (Address Resolution Protocol)

Purpose: Find MAC address from IP

ARP Request (Broadcast):
Source: 192.168.1.10 (MAC: AA:BB:CC:DD:EE:FF)
Destination: 255.255.255.255 (MAC: FF:FF:FF:FF:FF:FF)
Question: "Who has 192.168.1.20? Tell 192.168.1.10"

ARP Reply (Unicast):
Source: 192.168.1.20 (MAC: 11:22:33:44:55:66)
Destination: 192.168.1.10 (MAC: AA:BB:CC:DD:EE:FF)
Answer: "192.168.1.20 is at 11:22:33:44:55:66"

2. DHCP (Dynamic Host Configuration Protocol)

DHCP Discover (broadcast):

Source IP: 0.0.0.0
Destination IP: 255.255.255.255
Source MAC: Client's MAC
Destination MAC: FF:FF:FF:FF:FF:FF
Message: "I need an IP address!"

DHCP Offer (unicast or broadcast):

Server responds with available IP

3. NetBIOS Name Service

Windows networking (legacy):

Port: UDP 137
Purpose: Name resolution
Broadcasts: "Who is COMPUTER-NAME?"

4. RIP (Routing Information Protocol)

Version 1 uses broadcast:

Destination: 255.255.255.255
Purpose: Share routing tables
Modern networks: Use RIPv2 (multicast) or OSPF

Viewing Broadcast Traffic

Using Wireshark:

Capture filter:
broadcast

Display filter:
eth.dst == ff:ff:ff:ff:ff:ff

Or:
ip.dst == 255.255.255.255

What you'll see:

  • ARP requests
  • DHCP Discover messages
  • NetBIOS name queries
  • mDNS/Bonjour announcements

Using tcpdump:

# Capture broadcast traffic
sudo tcpdump -i eth0 broadcast

# More specific
sudo tcpdump -i eth0 'ether dst ff:ff:ff:ff:ff:ff'

# ARP broadcasts
sudo tcpdump -i eth0 arp

# DHCP broadcasts
sudo tcpdump -i eth0 port 67 or port 68

Example Output:

15:23:45.123456 ARP, Request who-has 192.168.1.1 tell 192.168.1.100
15:23:45.234567 DHCP, Request from aa:bb:cc:dd:ee:ff
15:23:46.345678 NetBIOS-NS, Query for WORKSTATION

Security Implications

1. Information Disclosure

Broadcasts reveal:

  • Active IP addresses
  • MAC addresses
  • Hostnames (NetBIOS)
  • Network topology
  • DHCP server location

Passive reconnaissance:

# Listen for broadcasts
sudo tcpdump -i eth0 broadcast -w broadcasts.pcap

# Analyze later
wireshark broadcasts.pcap

# Find:
# - DHCP server: Who's offering IPs?
# - Gateway: Who's sending ARP for internet IPs?
# - Active hosts: Who's doing ARP requests?

2. Broadcast Storms

Cause: Switching loops without STP

Switch A ──────── Switch B
    │                 │
    └─────Switch C────┘

Without Spanning Tree Protocol:
1. Broadcast sent
2. Each switch forwards to all ports
3. Broadcast loops infinitely
4. Network saturated → unusable

Symptoms:

  • Network extremely slow or down
  • Switch lights blinking rapidly
  • CPU usage on switches maxed

Fix:

# Enable Spanning Tree Protocol
# (Usually enabled by default)

# Cisco example:
spanning-tree mode rapid-pvst

3. DDoS Attacks (Smurf Attack)

How it works:

1. Attacker spoofs victim's IP as source
2. Sends ICMP echo request to network broadcast
   Destination: 192.168.1.255
3. All hosts respond to victim's IP
4. Victim overwhelmed by responses

Example:
1 attacker packet → 254 responses
Amplification: 254x

Mitigation:

# Disable directed broadcast on routers
# Cisco:
interface GigabitEthernet0/1
 no ip directed-broadcast

# Linux (iptables):
iptables -A INPUT -m pkttype --pkt-type broadcast -j DROP

4. ARP Spoofing via Broadcast

Gratuitous ARP (unsolicited ARP broadcast):

Legitimate use:
"I'm 192.168.1.10 at AA:BB:CC:DD:EE:FF"
Purpose: Update ARP caches

Malicious use:
Attacker sends:
"I'm 192.168.1.1 (gateway) at ATTACKER-MAC"
All hosts update ARP cache
Now all traffic goes through attacker (MITM)

Broadcast Tools and Commands

Linux:

# Send broadcast ping
ping -b 192.168.1.255

# Note: Often disabled for security
# Enable if needed:
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# View broadcast address
ip addr show
# Look for "brd" field

# Calculate broadcast address
ipcalc 192.168.1.0/24

# Send custom broadcast packet (requires root)
nping --udp -p 9 --dest-ip 192.168.1.255 --data-string "HELLO"

Windows:

# View network configuration (includes broadcast)
ipconfig /all

# PowerShell: Calculate broadcast
Get-NetIPAddress | Select-Object IPAddress, PrefixLength

# Ping broadcast (often blocked)
ping 192.168.1.255

Python Script:

#!/usr/bin/env python3
import socket

# Create UDP socket
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)

# Send broadcast message
message = b"Hello, network!"
sock.sendto(message, ('192.168.1.255', 9999))

print("Broadcast sent!")
sock.close()

Broadcast Address Calculation Practice

Exercise 1:

IP: 192.168.10.0/24
Subnet mask: 255.255.255.0
Broadcast address: ?
Answer
/24 = 256 addresses
Host range: 192.168.10.1 - 192.168.10.254
Broadcast: 192.168.10.255

Exercise 2:

IP: 10.0.0.0/8
Broadcast address: ?
Answer
/8 = 16,777,216 addresses
Network: 10.0.0.0
Broadcast: 10.255.255.255

Exercise 3:

IP: 172.16.50.0/22
Broadcast address: ?
Answer
/22 = 1024 addresses
Network aligns to: 172.16.48.0
Broadcast: 172.16.51.255

Calculation:
Host bits: 32 - 22 = 10
2^10 = 1024
172.16.48.0 + 1023 = 172.16.51.255

Try It Yourself

Exercise 1: Capture Broadcasts

# Capture 100 broadcast packets
sudo tcpdump -i eth0 -c 100 broadcast -w broadcasts.pcap

# Analyze in Wireshark
wireshark broadcasts.pcap

# Questions:
# - How many ARP requests?
# - Any DHCP traffic?
# - NetBIOS queries?
# - What hostnames appear?

Exercise 2: Calculate Broadcast Addresses

Use ipcalc:

# Install
sudo apt install ipcalc  # Debian/Ubuntu
brew install ipcalc       # macOS

# Calculate
ipcalc 192.168.1.0/24
ipcalc 10.10.0.0/16
ipcalc 172.16.32.0/20

# Verify broadcast addresses

Exercise 3: Send Broadcast

⚠️ Lab environment only!

# UDP broadcast
echo "TEST" | nc -u -b 192.168.1.255 9999

# Or Python:
python3 << EOF
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
s.sendto(b"Hello", ('192.168.1.255', 9999))
s.close()
EOF

# Capture on another machine to verify

Broadcast vs Multicast

Broadcast:
- To: ALL devices on network
- Efficient: No
- Example: 192.168.1.255

Multicast:
- To: Specific group of devices
- Efficient: Yes
- Example: 224.0.0.1 (all systems)
           239.255.255.250 (SSDP)

Unicast:
- To: Single specific device
- Efficient: Yes
- Example: 192.168.1.20

Broadcast Quick Reference

# Calculate broadcast
ipcalc <network>/<cidr>

# View broadcast address
ip addr show | grep brd

# Capture broadcasts
sudo tcpdump -i eth0 broadcast

# Wireshark filter
eth.dst == ff:ff:ff:ff:ff:ff
ip.dst == 255.255.255.255

# Send broadcast (Python)
socket.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
sock.sendto(data, ('<broadcast>', port))

# Disable directed broadcasts (Cisco)
no ip directed-broadcast

Common Broadcast Addresses

Network Class         Broadcast
─────────────────────────────────────
Class A (/8)         10.255.255.255
Class B (/16)        172.16.255.255
Class C (/24)        192.168.1.255

Special:
Limited broadcast    255.255.255.255
Loopback "network"   127.255.255.255 (theoretical)

Resources

Tools:

  • ipcalc: Calculate broadcast addresses
  • Wireshark: Analyze broadcast traffic
  • tcpdump: Capture broadcasts
  • nmap: Network discovery using broadcasts

Reading:

Practice:

  • Capture and analyze broadcast traffic on your network
  • Practice calculating broadcast addresses for different subnet masks
  • Understand how ARP and DHCP use broadcasts

Next Steps

  1. Master subnet calculations including broadcast addresses
  2. Analyze broadcast traffic in Wireshark
  3. Understand ARP and how it uses broadcasts
  4. Learn about VLANs to segment broadcast domains
  5. Study multicast as an efficient alternative

Broadcast addresses are fundamental to network operations. Understanding them helps with troubleshooting, security analysis, and network design!

"Broadcast: When one voice reaches every ear on the network."

Up next

Loopback Address

The localhost and loopback interface explained.