8.2 Ethernet switching, VLANs, and Loop Protection

A new row of switches has been installed inside the station, and broadcasts are now looping. Teams that were previously isolated have unexpectedly appeared on the same network.

An Ethernet switch forwards frames within the same VLAN/broadcast domain based on the destination MAC address, and simultaneously learns the forwarding database (FDB) by observing the source MAC address of incoming frames. These two statements form the foundation for understanding most Layer 2 behavior.

1. Switch Source, Lookup Destination

A frame enters through port 3, VLAN 10, with source MAC address A. The switch writes or refreshes the entry for (VLAN 10, A) -> port 3 into the FDB. It then looks up the destination MAC address B:

• Known unicast: B is in the FDB; the frame is forwarded to the corresponding egress port.
• Unknown unicast: The frame is flooded to all eligible ports within the VLAN except the ingress port.
• Broadcast: The frame is flooded across all ports in the VLAN.
• Multicast: Depends on multicast snooping or registration status; if no such state exists, the frame may be flooded across the entire VLAN.

FDB entries age out over time. When the same source MAC address arrives from a new port, the switch typically updates the mapping. Rapid back-and-forth movement between ports can result in MAC flapping, a common symptom of underlying issues such as loops, misconfigured bondings or bridges, or duplicate MAC addresses.

# Linux bridge FDB
bridge fdb show

2. Collision Domain and Broadcast Domain

A hub acts as a physical-layer repeater, where all ports share the same medium and collision domain. In contrast, each full-duplex point-to-point port on a switch operates independently for sending and receiving traffic, and does not use CSMA/CD to compete for shared media.

By default, a switch does not segment the broadcast domain: broadcast frames destined for devices within the same VLAN are flooded across all ports. VLANs divide a physical switching infrastructure into multiple logical broadcast domains. The FDB key should be understood as (VLAN, MAC), not a single mapping from MAC address to all switches, instead, it represents a per-VLAN, per-port mapping.

3. 802.1Q tag

Untagged Ethernet II header:

Destination | Source | EtherType | Payload

802.1Q-tagged header:

Destination | Source | TPID 0x8100 | TCI | inner EtherType | Payload

The tag adds 4 bytes. The TCI field includes the priority code point (PCP), drop eligible indicator (DEI), and a 12-bit VLAN ID. As a result, the maximum frame size increases from 1518 to 1522 bytes (excluding preamble/SFD). Provider bridging and QinQ support multiple layers of tags, so parsers should not assume that EtherType is always at offset 12 or that only a single tag exists.

Access and trunk are switch configuration concepts, not inherent port types in an Ethernet frame:

• An access port typically assigns untagged host traffic to a single VLAN and tags it upon egress;
• A trunk port typically allows a set of tagged VLANs to pass through;
• Native VLAN, PVID, and untagged VLAN behavior varies by vendor and configuration; mismatches between endpoints can lead to VLAN leakage or connectivity failures;
• The allowed VLAN list should be minimized, do not default all VLANs to pass through a trunk.

4. Inter-VLAN Communication Is Routing

A host in VLAN 10 needs to access a host in VLAN 20. The source host forwards the packet to the default gateway MAC address within VLAN 10. The router or L3 switch then selects the appropriate route at the IP layer and encapsulates a new Ethernet frame destined for VLAN 20.

VLANs provide Layer 2 broadcast isolation but do not automatically enforce application-level authorization or establish a complete security boundary. Independent design is still required for inter-VLAN ACLs/firewalls, host security, 802.1X/NAC, and management-plane protection. Vulnerabilities such as VLAN hopping and mis-tagging invalidate the assumption that "being on a different VLAN guarantees absolute security."

5. Why L2 Loops Amplify

Ethernet frames don't have a built-in loop limit like IP TTL or Hop Limit, which decrement with each hop. A broadcast or unknown-unicast frame circulating through redundant L2 links can cause switches to continuously flood duplicates, consuming link and control-plane resources. This flooding also causes the Forwarding Database (FDB) to observe the source MAC address moving back and forth between multiple ports.

Physical redundancy alone (just plugging in two cables) does not guarantee doubled bandwidth or network stability. Without loop prevention mechanisms such as STP/RSTP, link aggregation, or a routed fabric, the logical topology is effectively compromised. Simply connecting two cables does not equate to a safe or reliable doubling of bandwidth; explicit control mechanisms are required.

6. The Goal of STP/RSTP is to Establish a Loop-Free Active Topology

The STP family uses Bridge Protocol Data Units (BPDU) to elect a root bridge, compute path costs to the root, assign roles and states to ports, and ensure that certain redundant paths do not forward ordinary data frames. After topology changes, the protocol re-converges to restore a single loop-free path.

Classic 802.1D STP relies on fixed default timers, which can result in convergence times of tens of seconds. However, a fixed 50-second timeout does not guarantee responsiveness for all topology changes, events, or configuration updates. RSTP improves upon this by refining role and state management and introducing the proposal/agreement mechanism, enabling faster convergence on point-to-point links. Still, actual convergence times depend on topology structure, edge-port configurations, failure detection mechanisms, and device compatibility, therefore, a guaranteed convergence time of 1–3 seconds cannot be assured.

Operational safeguards:

• Clearly define root bridge placement and priority to prevent arbitrary access switches from becoming root;
• Use Edge/PortFast only on edge ports that are not intended to connect switches, and combine it with BPDU Guard;
• Apply Root Guard and Loop Guard based on specific failure scenarios;
• Never disable STP globally in the absence of alternative loop prevention mechanisms;
• In datacenter leaf-spine topologies, L3 boundaries are often pushed down to reduce L2 failure domains; however, server-facing segments may still rely on L2 mechanisms.

7. L2 Security Requires Independent Control

ARP/NDP, DHCP, and source MAC addresses are not cryptographic identities. In a managed network, mechanisms such as DHCP snooping, Dynamic ARP Inspection, RA Guard, port security, 802.1X, and control-plane policing can be deployed, but each relies on assumptions about network topology and trust boundaries. Misconfiguration can block legitimate failover traffic, static host assignments, or IPv6 control traffic.

Do not use packet-crafting tools to send ARP, BPDU, or tagged frames for experimentation on unauthorized networks. Teaching experiments should be conducted within isolated namespaces, virtual labs, or on dedicated switches.

8. Diagnostics Order

1. Verify interface link state, speed/duplex settings, and error counters.
2. Confirm the ingress port's VLAN/PVID configuration and trunk allowed VLAN list.
3. Check which port (VLAN, source MAC) has learned in the FDB and whether it is flapping.
4. Distinguish between known unicast, unknown unicast, broadcast, and multicast flooding events.
5. Examine STP root bridge, port role and state, topology change events, and BPDU guard activity.
6. If the issue spans VLANs, escalate to route/ACL/firewall configurations, do not limit troubleshooting to FDB alone.

9. Acceptance Questions

1. From which frame address does a Switch learn FDB entries, and from which address does it look up egress destinations?
2. Why does an unknown unicast flood, and how does the FDB change after it learns the entry?
3. Draw the location where an 802.1Q tag is inserted, and explain the roles of TPID and TCI.
4. Why can VLAN separation not replace firewall authorization?
5. If a source MAC is flapping between two trunk ports, which three root causes would you investigate first?

Next lesson: 8.3 MTU, IP fragmentation, and Path MTU Discovery

References:

• IEEE 802.1Q: VLAN Tagging Standard
• RFC 1191: Path MTU Discovery
• IEEE 802.1D: Spanning Tree Protocol
• OpenFlow Specification v1.3
• Cisco Catalyst Switch Configuration Guide

References

• IEEE 802.1Q: Bridges and Bridged Networks
• IEEE 802.1D: MAC Bridges