By 1984, the Internet had a problem nobody had planned for: subnets. RFC 950 was carving Class A/B/C networks into smaller pieces with subnet masks, but the broadcasting model from RFC 919 assumed a flat network. If a host wants to shout "is anyone there?", what address does it use? And what should routers do with it? RFC 922, written by Jon Postel in October 1984, is the four-page document that answers those questions — and accidentally sets up some of the most consequential security incidents of the 1990s.

Postel distinguishes three kinds of broadcast:

• Limited broadcast — 255.255.255.255, an all-ones destination. It MUST NOT be forwarded by routers. It reaches only the local physical network. This is why DHCP clients (who don't yet have an IP) can still find a server: the discover packet goes to 255.255.255.255 and only the local link sees it.
• Network-directed broadcast — host portion all ones (e.g. 192.0.2.255 for a /24). A router treats this like a regular unicast until it reaches the destination network, then flood-delivers it.
• Subnet-directed broadcast — same idea but addressing a specific subnet inside a subnetted network. The packet is routed normally across the internet, and only the final hop turns it into a link-layer broadcast.

The clever design choice here is that broadcasts traverse the routed Internet as unicasts. A host in Berkeley could send one packet to 10.255.255.255 and every host on MIT's network 10 would receive it. In 1984 that felt elegant — a single packet, fan-out at the edge. It also meant Postel had to settle a religious war: should "all hosts" be encoded as all ones or all zeros? Both conventions existed in deployed code (BSD 4.2 used all-zeros). RFC 922 standardizes on all-ones and politely deprecates all-zeros, while acknowledging that fixing every host would take years.

And then the 1990s happened. In 1997, somebody noticed that directed broadcasts plus ICMP equals a force multiplier. Send one spoofed ICMP echo to x.y.z.255, the destination network turns it into hundreds of echo replies, all aimed at your victim. The Smurf attack was, in essence, RFC 922 working exactly as designed — just used by someone with bad intentions. The fix came in RFC 2644 (2000), which flipped the default: routers SHOULD NOT forward directed broadcasts. Cisco IOS made no ip directed-broadcast the default in 12.0. A core piece of Postel's elegant 1984 design was quietly amputated, and almost nobody noticed because almost nobody had been using directed broadcasts on purpose.

What survives from RFC 922 today is the part that's invisible until it isn't:

• 255.255.255.255 is still how DHCP, BOOTP, and some discovery protocols bootstrap.
• The all-ones host-bits convention is baked into ifconfig, every routing stack, and every subnet calculator.
• The rule that limited broadcast is link-local-only is why your tcpdump never sees a stranger's DHCP discover.

It's also a reminder of how protocol design ages. Postel optimized for fan-out efficiency in a small, trusting network. Twenty years later we discovered that the same property is a denial-of-service weapon, and the right answer was to disable it. IPv6 took the lesson to heart — it has no broadcast at all, only multicast, where the sender must use an explicit group address and receivers opt in.