bridge

A Linux bridge is a switch in software, and bridge is how you look inside it. bridge link lists its ports with their state: forwarding, or blocking, listening, learning while spanning tree decides. bridge fdb is the MAC address table (the forwarding database): each learned address with the port (dev) it is behind. bridge mdb is the multicast database an IGMP-snooping bridge builds: each group with the ports whose devices joined it. bridge vlan is a VLAN-filtering bridge's show vlan: the VLANs of each port, with PVID (untagged frames coming in belong to it) and Egress Untagged (its frames leave without a tag). The bridge's own settings, such as its aging time, spanning tree priority and table size, are changed with ip link set br0 type bridge … and shown by ip -d link show br0. It replaced brctl.

bridge command usage

bridge link [show [dev PORT]]
bridge [-s] fdb show [br BRIDGE] [dynamic]
bridge mdb show
bridge fdb add|del|replace MAC dev PORT master [static] [sticky]
bridge link set dev PORT cost COST
bridge vlan show [dev PORT]
bridge vlan add|del dev PORT vid VID [pvid] [untagged] [self]

Options

fdb show br br0

the MAC table of the bridge br0

dynamic

only learned entries, not the bridge's own or typed-in ones

-s

with timers: seconds since each entry was used and updated

static sticky

an entry typed in by hand that never ages out and never moves

vlan add … vid 10 pvid untagged

an access port in VLAN 10 (or a trunk's native VLAN)

vlan add … vid 20

VLAN 20 allowed on the port, tagged: a trunk

self

on the bridge itself (br0), for the switch's own VLAN cards

bridge examples

bridge link show

Lists the switch's ports and whether each is forwarding or blocking.

bridge fdb show br br0 dynamic

Lists the MAC addresses the switch has learned, each with its port.

bridge -s fdb show br br0 dynamic

The same, with how many seconds ago each entry was last used and refreshed.

ip link set br0 type bridge fdb_flush

Empties the learned MAC table.

ip -d link show br0 | grep -o 'designated_root [^ ]*'

Shows which switch this one believes is the spanning tree root.

bridge mdb show

Lists the multicast groups the switch has seen joined, each with the port behind which a member is.

ip link set br0 type bridge mcast_snooping 1

Turns IGMP snooping on, so multicast goes only to ports that joined.

bridge vlan show

Lists each port's VLANs: which one is untagged (PVID) and which are tagged.

bridge vlan del dev coreSwitch vid 20

Removes VLAN 20 from the allowed VLANs of the trunk port to coreSwitch.

bridge fdb append 00:00:00:00:00:00 dev vxlan100 dst 10.0.2.2

Adds the VTEP 10.0.2.2 to a VXLAN tunnel's flood list: broadcasts and unknown frames are copied to it.

bridge fdb show dev vxlan100

Lists the MACs a VXLAN tunnel learned, each with dst, the VTEP it is behind.

Reading the output

$ bridge fdb show br br0 dynamic
82:90:a6:ac:49:8c dev alice master br0
c6:96:68:18:e9:06 dev bob master br0

• Each line: a MAC address the switch has seen as a source, and the port (dev) it arrived on.
• A device that has sent nothing lately has no line: frames for it are flooded out of every port.

Pitfalls

• Without dynamic, the list also holds the bridge's own addresses, marked permanent: they are not learned devices.
• bridge link set dev PORT state 3 does not unblock a port while spanning tree runs: the protocol decides port states.
• bridge vlan only filters when the bridge has vlan_filtering 1; without it every frame crosses whatever its tag.

Run it on real machines