Chapter 7 — Switches, and what "broadcast domain" means

In one sentence

A switch learns which device is on which port and sends each frame only where it needs to go — but broadcasts still reach everyone, and that group is called a broadcast domain.

The problem

Old networks (with hubs) copied every frame to every port. Every device saw everyone's traffic: wasteful, slow, and completely insecure. With 20 devices, 19 copies of every frame were pointless.

The idea, in plain language

The switch learns by listening. Every time a frame arrives, it notes "device with MAC aa:aa is on port 3". Next time a frame is addressed to aa:aa, it sends it out port 3 only.

How it actually works

   Switch's MAC address table (it builds this itself, by watching):

     MAC address          Port
     -----------          ----
     aa:aa:aa:aa:aa:aa      3       <- learned when device on port 3 sent a frame
     bb:bb:bb:bb:bb:bb      7
     cc:cc:cc:cc:cc:cc      1

   For each arriving frame:
     1. LEARN:  note the SOURCE MAC and the port it came in on
     2. LOOK UP the DESTINATION MAC:
          - found?      -> send out ONLY that port          (unicast forwarding)
          - not found?  -> send out ALL ports except the incoming one (flooding)
          - broadcast?  -> send out ALL ports except the incoming one

Entries expire (typically after 5 minutes) so devices can move.

Collision domain vs broadcast domain

Two terms that sound similar and confuse everyone.

Term	Meaning	Today
Collision domain	Set of devices that could interfere with each other if they transmit simultaneously	Each switch port is its own collision domain. Collisions are effectively extinct on modern wired networks.
Broadcast domain	Set of devices that receive each other's broadcasts (like ARP)	This still matters a lot.

The rule to remember:

A SWITCH does NOT break up a broadcast domain.
A ROUTER (or a VLAN boundary) DOES.

So if you plug 200 devices into a chain of switches, all 200 are in one broadcast domain — every ARP request from any of them reaches all of them. That's fine at 200; it's a problem at 2,000. Rule of thumb: keep a broadcast domain under a few hundred devices.

VLANs, briefly

A VLAN (Virtual LAN) lets one physical switch behave as several separate switches. Ports are tagged with a VLAN number; devices in VLAN 10 cannot see broadcasts from VLAN 20 — they're separate broadcast domains — and traffic between them must pass through a router.

This is how one office switch safely carries guest Wi-Fi, staff machines, VoIP phones, and CCTV without them seeing each other.

The loop danger (why STP exists)

If you accidentally connect two switches with two cables, a broadcast frame can circle forever — because, unlike IP packets, Ethernet frames have no TTL (hop counter). Within seconds the network saturates. This is a broadcast storm, and it takes down whole offices.

STP (Spanning Tree Protocol) prevents it: switches talk to each other, detect loops, and deliberately block redundant ports until they're needed. If you ever add a redundant link between switches, make sure STP is on.

Practice (20 min)

A. See a software switch. Docker creates one on your machine:

# Linux, if you have Docker
bridge link                 # show bridge ports
bridge fdb show | head -20  # the MAC address table -- exactly as described above

B. Prove that a switch filters traffic. Ping between two devices on your network while capturing on a third device. With a switch, you should see almost none of their traffic (only broadcasts). With an old hub, you'd see everything.

C. Watch broadcasts:

sudo tcpdump -i any -n 'broadcast or multicast'

Leave it running for a minute. You'll see ARP requests, DHCP, mDNS (.local name discovery), SSDP (device discovery), and more. Every device on your network is doing this constantly. That's the broadcast domain at work.

Common confusions

"Switch vs router?" Switch = forwards by MAC, within one network, layer 2. Router = forwards by IP, between networks, layer 3. Your home "router" box is actually a router + switch + Wi-Fi access point + firewall + DHCP server in one case.
"Is my Wi-Fi access point a switch?" Functionally similar — it bridges wireless devices into the wired network and forwards by MAC.
"Managed vs unmanaged switch?" Unmanaged = plug in and it works. Managed = you can configure VLANs, STP, port security, monitoring.

Check yourself

How does a switch learn which device is on which port?
What does a switch do with a frame whose destination MAC it doesn't know?
Does a switch break up a broadcast domain? What does?
Why is a Layer 2 loop more dangerous than a Layer 3 (IP) loop?