2.2 Bridging, Switching, and Collision/Broadcast Domains

Bridging, Switching, and Collision/Broadcast Domains

Modern enterprise and service provider campus networks rely on Layer 2 Ethernet switches to interconnect endpoints, servers, and provider edge routers. While early local networks utilized passive physical repeaters and shared hubs, the modern Ethernet landscape is defined by transparent bridging and high-density hardware switching. Understanding how a switch makes forwarding decisions, learns endpoint topologies, isolates collision domains, and handles broadcast propagation is fundamental to building scalable, loop-free network architectures.

---

Evolution of Local Area Network Infrastructure

To appreciate the architecture of modern switches, one must understand the three successive generations of Layer 2 network hardware:

1. Legacy Multiport Repeaters (Hubs)

Hubs operate purely at Layer 1 (Physical Layer). When a hub receives electrical signals on one port, it blindly amplifies and retransmits (repeats) those bits out all other connected ports. A hub has no awareness of MAC addresses, Ethernet framing, or packet boundaries. Consequently:

• All connected hosts share a single collision domain.
• All connected hosts share a single broadcast domain.
• Communication is restricted to half-duplex mode.
• Total network bandwidth is divided across all devices (e.g., eight hosts on a 10 Mbps hub share 10 Mbps aggregate throughput).

2. Transparent Bridges

Introduced under IEEE 802.1D, bridges operate at Layer 2 (Data Link Layer). Bridges analyze Ethernet frame headers, inspect MAC addresses, and build a software-maintained forwarding table. By inspecting destination MAC addresses, a bridge decides whether to forward a frame across segments or filter it. Bridges successfully broke large networks into separate collision domains, but their forwarding performance was severely constrained by software-based CPU processing and low port counts (typically 2 to 4 ports).

3. Layer 2 Ethernet Switches

A switch is essentially a high-density, hardware-accelerated multiport bridge. Modern switches use Application-Specific Integrated Circuits (ASICs) or specialized network processing units (such as Nokia FP silicon) to perform MAC lookups and frame forwarding at line rate (wire speed) with nanosecond-level latency. Switches introduce microsegmentation: each port provides a dedicated communication channel operating in full duplex, entirely eliminating collisions.

---

Switch Forwarding Logic: The Five Operational Pillars

When an Ethernet frame arrives on a switch port, the switch executes a deterministic five-step forwarding and filtering algorithm based on its Forwarding Database (FDB), also referred to as the Content-Addressable Memory (CAM) table.

Incoming Frame: [ DMAC | SMAC | EtherType | Payload | FCS ]
                     |      |
                     |      +--> Step 2: LEARN (Inspect Source MAC -> Update FDB)
                     +---------> Step 3: FORWARD / FILTER / FLOOD (Lookup Destination MAC)

Pillar 1: Frame Ingress & FCS Integrity Verification

In a store-and-forward switch, the hardware receives the complete frame before forwarding and recalculates the 32-bit CRC against the Frame Check Sequence (FCS) field. If a CRC mismatch or runt condition is detected, the frame is silently discarded to avoid propagating corrupted data across the network.

Pillar 2: Source MAC Address Learning

The switch examines the Source MAC address of the arriving frame to learn the physical location of the transmitting device:

1. The switch inspects the ingress port number and the VLAN assignment of the frame.
2. It queries the FDB for an existing entry matching the Source MAC and VLAN.
3. New Device: If the Source MAC does not exist in the FDB, the switch creates a new dynamic entry: [MAC Address, Ingress Port, VLAN, Timestamp].
4. Existing Device on Same Port: If the Source MAC already exists on that exact port, the switch refreshes the entry's aging timer back to zero.
5. Station Movement (MAC Flapping/Move): If the Source MAC already exists in the FDB but was previously associated with a different port, the switch immediately updates the entry with the new port association. (Frequent alternating updates between ports indicate a Layer 2 loop or duplicate MAC address).

Pillar 3: Destination MAC Lookup and Forwarding Decisions

Next, the switch inspects the Destination MAC address to determine where to transmit the frame:

• Known Unicast Forwarding: If the Destination MAC is present in the FDB and associated with an egress port different from the ingress port, the switch directs the frame exclusively out that single designated egress port.
• Filtering (Discarding): If the Destination MAC is present in the FDB and is associated with the same port where the frame arrived, the switch drops (filters) the frame. Because the destination station resides on the same physical segment as the sender, it has already received the transmission directly.
• Unknown Unicast Flooding: If the Destination MAC is a unicast address (I/G bit = 0) but does not exist in the FDB, the switch floods a copy of the frame out all active ports in the same VLAN except the ingress port. Flooding makes the frame available on eligible member ports; failed, blocked, or filtered paths can still prevent delivery. When the destination responds, the switch learns its Source MAC, populating the FDB and terminating future flooding.
• Broadcast Flooding: If the Destination MAC is the broadcast address (FF:FF:FF:FF:FF:FF), the switch floods the frame out every port belonging to that VLAN except the ingress port.
• Multicast Flooding: If the Destination MAC is a multicast group address (I/G bit = 1), the switch floods the frame across the VLAN by default, unless Layer 2 multicast optimization (such as IGMP Snooping) is active to constrain traffic to registered subscriber ports.

Pillar 4: FDB Aging Mechanics

To prevent the Forwarding Database from filling up with stale or obsolete entries when devices disconnect or move, dynamic FDB entries are governed by an aging timer:

• Default Aging Duration: For conventional SR OS VPLS, local dynamic MAC aging defaults to 300 seconds; remote entries have a separate timer. Inspect the configured service and release.
• Timer Reset: Every time a frame arrives with a matching Source MAC on the associated port, the aging timer for that entry resets to 0.
• Expiration: If no frames are observed from a learned MAC address for 300 consecutive seconds, the switch flushes the entry from the FDB. Any subsequent frames destined for that MAC will trigger unknown unicast flooding until the host transmits again.
• Static Entries: Network administrators can manually configure static FDB entries for high-security endpoints or management interfaces. Static entries never age out and persist until manually deleted.

Pillar 5: Content-Addressable Memory (CAM) Table Overflow Protection

Hardware switches maintain their FDB in high-speed CAM (Content-Addressable Memory). Unlike standard RAM where an address is queried to return data, CAM allows searching data (a 48-bit MAC address) in parallel in a single clock cycle to return the port number. If a malicious attacker floods a switch with thousands of randomized fake source MAC addresses (a CAM table exhaustion / MAC flooding attack), the FDB fills to maximum capacity. When the table overflows, the switch may be unable to learn additional sources. Unknown destinations may be flooded within their VLAN, while known destinations can still be forwarded normally. Platform settings may instead discard excess traffic. Switches employ port security and MAC learning limits to prevent CAM exhaustion.

---

Collision Domains vs. Broadcast Domains: Architectural Contrast

A clear understanding of collision and broadcast domains is essential for network design and certification:

Collision Domain

A collision domain is a physical or logical network segment bounded by Layer 2 or Layer 3 interfaces where data packets can collide with one another if transmitted simultaneously:

• In a Hub: All ports on a hub belong to a single shared collision domain. When two or more connected stations transmit concurrently, their electrical signals collide, corrupting data.
• In a Switch: Each individual switch port represents an independent, isolated collision domain. When operating in full-duplex mode with a dedicated host connection, collisions are physically impossible. Switches eliminate collisions through microsegmentation.

Broadcast Domain

A broadcast domain encompasses all network nodes that receive and process an Ethernet broadcast frame (FF:FF:FF:FF:FF:FF) sent by any device within that domain:

• Switches Do Not Break Broadcast Domains: By default, all ports on an unconfigured Layer 2 switch belong to a single common broadcast domain. Switches normally flood eligible broadcast and unknown-unicast traffic within its VLAN, excluding ingress and obeying forwarding restrictions.
• Routers Break Broadcast Domains: Routers operate at Layer 3 and terminate Layer 2 frames. Routers do not forward Layer 2 broadcasts across interfaces. Each routed interface represents a distinct broadcast domain boundary.
• VLANs Segment Broadcast Domains: Within a switch, creating Virtual Local Area Networks (VLANs) partitions the physical switch into multiple isolated logical broadcast domains.

---

Layer 2 Redundancy Hazards: Loops, Storms, and MAC Flapping

To ensure high availability, enterprise and service provider networks incorporate redundant physical links between switches. However, without a Layer 2 control protocol, redundant topologies create catastrophic network failure:

1. Broadcast Storms

Ethernet frame headers contain no Time to Live (TTL) or hop-count field. When an endpoint emits an ARP request broadcast into a looped Layer 2 topology, the switches flood the broadcast out all ports. The redundant switch receives the broadcast and floods it back onto the original switch. Without suitable loop control, frames can circulate repeatedly and replication can overwhelm links and forwarding resources. The growth and failure time depend on the topology and offered traffic.

2. MAC Flapping (CAM Table Instability)

As looped duplicate frames arrive alternately over primary and redundant switch ports, the switch's learning engine constantly overwrites its FDB port bindings. The FDB rapidly oscillates between port mappings (e.g., MAC AA:BB:CC on Port 1/1/1 $\rightarrow$ Port 1/1/2 $\rightarrow$ Port 1/1/1), exhausting CPU processing and causing legitimate unicast traffic to be misdirected or dropped.

3. Multiple Frame Copies

End-station receivers receive multiple identical copies of the same unicast or broadcast frame, causing transport-layer and application errors.

---

FDB Management on the Nokia 7750 Service Router

On the Nokia 7750 SR, Layer 2 multipoint switching is primarily delivered through the Virtual Private LAN Service (VPLS). A VPLS instance behaves as a distributed virtual switch, maintaining an independent FDB for each configured service:

## Displaying the learned MAC addresses in a specific VPLS service:
A:7750-SR# show service id 100 fdb detail

===============================================================================
Forwarding Database (Service: 100)
===============================================================================
ServId    MAC               Source-Identifier        Type     Last Change
-------------------------------------------------------------------------------
100       00:16:4d:11:22:33 sap:1/1/1:100            Learned  10/20/26 14:15:22
100       00:16:4d:aa:bb:cc sdp:1:100                Learned  10/20/26 14:18:05
100       00:16:4d:ff:ee:dd sap:1/1/2:100            Static   10/20/26 09:00:00
-------------------------------------------------------------------------------
No. of MAC Entries: 3
===============================================================================

Key SR OS FDB Configuration Parameters

• Configuring Table Size Limits: Administrators constrain the maximum number of MAC addresses learned per service using configure service vpls <service-id> fdb-table-size <max-entries> to protect against CAM exhaustion.
• Configuring MAC Aging: The aging duration can be adjusted or disabled per service using the Classic CLI local-age and remote-age settings under the VPLS context.
• MAC Move Protection: SR OS provides built-in MAC move detection (mac-move) to protect against Layer 2 loops and MAC spoofing. If a MAC address transitions between ports faster than a configured threshold, SR OS can block the offending port or suppress learning.

Primary technical reference

Specification or Nokia manual, checked October 20, 2026. Examples are teaching scenarios, not captured router execution.