8.2 Ethernet switching, VLANs, and Loop Protection
An Ethernet switch forwards frames within the same VLAN/broadcast domain based on the destination MAC address, and simultaneously learns the forwarding database (FDB) by observing the source MAC address of incoming frames. These two statements form the foundation for understanding most Layer 2 behavior.
1. Learn the Source, Look Up the Destination
Use independent VLAN learning for this example. A frame enters through port 3, VLAN 10, with source MAC address A. The switch writes or refreshes the entry for (VLAN 10, A) -> port 3 into the FDB. It then looks up the destination MAC address B:
- Known unicast: B is in the FDB; forward to its eligible egress port. If that is the ingress port, ordinary bridging filters the frame instead of sending it back.
- Unknown unicast: The frame is flooded to all eligible ports within the VLAN except the ingress port.
- Broadcast: Flood to eligible VLAN ports other than the ingress port.
- Multicast: Depends on multicast snooping or registration status; if no such state exists, the frame may be flooded across the entire VLAN.
Eligibility includes VLAN membership, forwarding state, and filtering rules; it does not mean every physical port. Special modes such as Linux bridge hairpin can permit transmission back through the ingress port.
Dynamically learned FDB entries age out; static entries normally follow different rules. When the same source MAC address arrives from a new port, the switch typically updates the mapping. Rapid back-and-forth movement between ports can result in MAC flapping, a common symptom of underlying issues such as loops, misconfigured bonds or bridges, or duplicate MAC addresses.
# Linux bridge FDB
bridge fdb show2. Collision Domain and Broadcast Domain
A hub acts as a physical-layer repeater, where all ports share the same medium and collision domain. In contrast, each full-duplex point-to-point port on a switch operates independently for sending and receiving traffic, and does not use CSMA/CD to compete for shared media.
By default, a switch does not segment the broadcast domain: broadcast frames are flooded within their VLAN to eligible ports. VLANs divide a physical switching infrastructure into multiple logical broadcast domains. In the independent-learning model used here, the key is (VLAN, MAC): one MAC can map to different ports in VLANs 10 and 20. The standard also allows shared VLAN learning. More generally, a filtering database ID (FID) identifies the learning domain; check the device’s VLAN-to-learning-domain mapping.
3. 802.1Q tag
Untagged Ethernet II header:
Destination | Source | EtherType | Payload802.1Q-tagged header:
Destination | Source | TPID 0x8100 | TCI | inner EtherType | PayloadThe tag adds 4 bytes. TCI contains a three-bit priority code point (PCP), one-bit drop eligible indicator (DEI), and 12-bit VLAN ID. Ordinary VLAN IDs are 1–4094; VID 0 carries priority without specifying a VLAN, and 4095 is reserved. A 12-bit field does not guarantee that a device can configure 4094 VLANs simultaneously.
The extra four bytes raise the usual maximum frame size from 1518 to 1522 bytes (excluding preamble/SFD). Tagging normally increases frame overhead without automatically reducing a 1500-byte IP MTU to 1496; verify that devices accept the larger frames. Provider bridging and QinQ support multiple layers of tags, so parsers should not assume that EtherType is always at offset 12 or that only a single tag exists.
Access and trunk are switch configuration concepts, not inherent port types in an Ethernet frame:
- An access port typically classifies untagged host traffic into one VLAN and sends it untagged on egress;
- A trunk port typically allows a set of tagged VLANs to pass through;
- Native VLAN, PVID, and untagged VLAN behavior varies by vendor and configuration; mismatches between endpoints can lead to VLAN leakage or connectivity failures;
- Keep the allowed VLAN list small instead of passing every VLAN by default.
For example, a VLAN 10 host sends an untagged frame to an access port, whose PVID classifies it into VLAN 10. An egress trunk requiring tags adds VID 10; the remote VLAN 10 access port removes it. If the two ends instead classify untagged trunk traffic into VLANs 10 and 20, the same frame acquires conflicting VLAN identities. Trace ingress classification and egress tagging at each hop; the port’s name is insufficient.
4. Inter-VLAN Communication Is Routing
A host in VLAN 10 needs to access a host in VLAN 20. Assuming different IP subnets and a route via a gateway, the source sends to its next-hop gateway MAC in VLAN 10. If it mistakenly treats the destination as on-link, it will try local ARP, which does not automatically cross VLANs. The router or L3 switch then selects the appropriate route at the IP layer and encapsulates a new Ethernet frame destined for VLAN 20.
VLANs provide Layer 2 broadcast isolation but do not automatically enforce application-level authorization or establish a complete security boundary. Independent design is still required for inter-VLAN ACLs/firewalls, host security, 802.1X/NAC, and management-plane protection. Vulnerabilities such as VLAN hopping and mis-tagging invalidate the assumption that "being on a different VLAN guarantees absolute security."
5. Why L2 Loops Amplify
Ethernet frames don't have a built-in loop limit like IP TTL or Hop Limit, which decrement with each hop. A broadcast or unknown-unicast frame circulating through redundant L2 links can cause switches to continuously flood duplicates, consuming link and control-plane resources. This flooding also causes the Forwarding Database (FDB) to observe the source MAC address moving back and forth between multiple ports.
Redundancy without a loop-prevention or multipath mechanism can break the logical topology. Two cables alone do not safely double bandwidth: use STP/RSTP, correctly configured link aggregation, or a routed fabric. Aggregation treats members as one logical link, but common flow hashing pins a flow to one member. Two 1 Gbit/s links therefore need not give one TCP flow 2 Gbit/s. Aggregation also does not prevent loops elsewhere in the network.
6. The Goal of STP/RSTP is to Establish a Loop-Free Active Topology
The STP family uses Bridge Protocol Data Units (BPDU) to elect a root bridge, compute path costs to the root, assign roles and states to ports, and keep some redundant paths from forwarding ordinary data frames. Root election favors the lower bridge ID, which includes configured priority and MAC-related fields; boot order does not decide it. A port blocking ordinary data still processes the relevant BPDUs; it is not an unplugged link. After topology changes, the protocol re-converges to restore a single loop-free path.
Common state names map as follows. States differ from port roles such as root, designated, or alternate:
| Behavior | Classic STP state | RSTP state |
|---|---|---|
| No source learning or ordinary data forwarding | blocking / listening (also disabled) | discarding |
| Source learning, no ordinary data forwarding | learning | learning |
| Source learning and data forwarding | forwarding | forwarding |
Classic 802.1D STP uses default timers, which can result in convergence times of tens of seconds. However, 50 seconds is not a universal convergence guarantee for every topology, event, or configuration. RSTP improves upon this by refining role and state management and introducing the proposal/agreement mechanism, enabling faster convergence on point-to-point links. Still, actual convergence times depend on topology structure, edge-port configurations, failure detection mechanisms, and device compatibility. Do not promise a universal 1–3 seconds.
Operational safeguards:
- Clearly define root bridge placement and priority to prevent arbitrary access switches from becoming root;
- Use Edge/PortFast only on edge ports that are not intended to connect switches, and combine it with BPDU Guard;
- Apply Root Guard and Loop Guard based on specific failure scenarios;
- Never disable STP globally in the absence of alternative loop prevention mechanisms;
- In datacenter leaf-spine topologies, L3 boundaries are often pushed down to reduce L2 failure domains; however, server-facing segments may still rely on L2 mechanisms.
7. L2 Security Requires Independent Control
ARP/NDP, DHCP, and source MAC addresses are not cryptographic identities. In a managed network, mechanisms such as DHCP snooping, Dynamic ARP Inspection, RA Guard, port security, 802.1X, and control-plane policing can be deployed, but each relies on assumptions about network topology and trust boundaries. Misconfiguration can block legitimate failover traffic, static host assignments, or IPv6 control traffic.
Do not use packet-crafting tools to send ARP, BPDU, or tagged frames for experimentation on unauthorized networks. Teaching experiments should be conducted within isolated namespaces, virtual labs, or on dedicated switches.
8. Diagnostics Order
- Verify interface link state, speed/duplex settings, and error counters.
- Confirm the ingress port's VLAN/PVID configuration and trunk allowed VLAN list.
- Check which port the FDB associates with
(VLAN, source MAC)and whether that mapping is flapping. - Distinguish between known unicast, unknown unicast, broadcast, and multicast flooding events.
- Examine STP root bridge, port role and state, topology change events, and BPDU guard activity.
- For communication across VLANs, inspect routes, ACLs, and firewalls; the FDB alone cannot explain the entire path.
9. Acceptance Questions
- From which frame address does a Switch learn FDB entries, and from which address does it look up egress destinations?
- Why does an unknown unicast flood, and how does the FDB change after it learns the entry?
- Draw the location where an 802.1Q tag is inserted, and explain the roles of TPID and TCI.
- Why can VLAN separation not replace firewall authorization?
- If a source MAC is flapping between two trunk ports, which three root causes would you investigate first?
Next lesson: 8.3 MTU, IP fragmentation, and Path MTU Discovery