7. Switches, broadcast domains, and VLANs

7.1 What a switch actually does

An Ethernet switch is a Layer 2 device that forwards frames based on a MAC address table (a.k.a. CAM/FIB table) it builds by learning:

Frame arrives on port 3 with src MAC aa:aa → switch records aa:aa → port 3 (with an aging timer, default 300 s).
Frame's dst MAC bb:bb is looked up:
- Hit → forward out only that one port (unicast forwarding).
- Miss (unknown) → flood out every port except the ingress (unknown-unicast flooding), hoping for a reply that teaches the table.
Broadcast (ff:ff:...) or multicast → flooded within the VLAN.

A switch has no IP involvement, no TTL, and (ideally) wire-speed forwarding in hardware (ASIC).

7.2 Collision domain vs broadcast domain

Collision domain: set of interfaces that can collide with each other. With full-duplex switched Ethernet, each port is its own collision domain — so collisions are effectively extinct. (Hubs, now obsolete, put everyone in one.)
Broadcast domain: set of interfaces a broadcast frame reaches. A switch does not break up a broadcast domain; a router (or a VLAN boundary) does. Every host in one broadcast domain shares ARP traffic, DHCP broadcasts, etc. Too large → "broadcast storm" risk and wasted CPU. Rule of thumb: keep a broadcast domain under ~500 hosts, or one /23.

7.3 VLANs: many virtual switches in one

A VLAN (Virtual LAN, 802.1Q) partitions one physical switch into multiple isolated broadcast domains. Ports are assigned VLAN IDs:

Access port: belongs to exactly one VLAN, sends/receives untagged frames (the endpoint doesn't know VLANs exist). "This port is in VLAN 20."
Trunk port: carries many VLANs between switches (or to a hypervisor/router), frames are tagged with their VLAN ID. One "native VLAN" may be untagged.

Traffic between VLANs must go through a router or L3 switch ("router-on-a-stick" or SVI). This is where inter-subnet policy/firewalling naturally lives.

7.4 Spanning Tree Protocol (STP)

Redundant links between switches create Layer 2 loops — and a broadcast frame in a loop circulates forever (no TTL at L2), melting the network in seconds. STP (802.1D) and successors (RSTP 802.1w, MSTP) elect a root bridge and block redundant ports, leaving a loop-free tree; a blocked port unblocks if the active path fails. Modern data centers often avoid STP entirely with routed/leaf-spine designs (Ch. 50) or link aggregation.

7.5 Link aggregation (LACP / bonding)

Bundle N physical links into one logical link for bandwidth and redundancy (bond0, port-channel, EtherChannel). Frames are hashed onto member links by src/dst MAC, src/dst IP, or L4 ports — so a single TCP flow still rides one physical link and can't exceed one link's speed. Aggregation adds capacity for many flows, not for one.

7.6 War story

After adding a second uplink "for redundancy," a whole floor went dark every few minutes. Someone had cabled two access switches together and left both plugged into the core — a loop — and STP was disabled on the cheap switches. Broadcast storm. Re-enabling RSTP (or just pulling one cable) fixed it instantly. Lesson: never create a second L2 path without STP or a LAG. At L2 there is no TTL to save you.

Try it yourself

bridge fdb show                     # Linux bridge MAC table (a software switch)
ip -d link show type vlan           # VLAN sub-interfaces
cat /proc/net/bonding/bond0         # bond status and active members
sudo tcpdump -i eth0 -e vlan        # show 802.1Q tags