Switch

A switch learns which MAC address sits behind which port from the frames it sees, and sends each frame only there. Broadcasts, and frames for addresses it has not learned yet, go out every port. Everything connected to one switch (or one VLAN of it) is one broadcast domain. A switch is not a hop: it does not lower the TTL, does not show up in traceroute, and devices store each other's MAC addresses, never the switch's. Linux builds one from a bridge (ip link add br0 type bridge), and bridge link and bridge fdb show its ports and table.

How a switch works, step by step

A switch joins devices into one network and forwards each Ethernet frame toward the port its destination MAC address was last seen on. It reads MAC addresses, not IP addresses, so it works one layer below routing. On Linux a switch is a bridge. In the switching lab alice 10.0.1.10, bob 10.0.1.11 and carol 10.0.1.12 each have one cable into officeSwitch, a bridge br0 whose only address, 10.0.1.13, is for management. The switch follows four rules (IEEE 802.1D):

1. Learn. A frame arriving on a port teaches the switch that its source MAC sits behind that port. Carol, who has sent nothing, is in no table yet.
2. Forward. When the destination MAC is known, the frame leaves by that one port only.
3. Flood. An unknown destination, or a broadcast (ff:ff:ff:ff:ff:ff), goes out every port but the one it came in on. This is why ARP and early frames reach everyone.
4. Age. An entry not refreshed for the aging time (300 seconds by default; 20 in the lab) is dropped, so a device that moves or goes quiet is relearned when it next sends.

Everything on one switch, or one VLAN of it, is a single broadcast domain. A switch is not a hop: it does not lower the TTL, never appears in traceroute, and devices store each other's MAC, never the switch's. Keeping several networks apart on one switch is the job of a VLAN.

What it looks like on a Linux machine

You build a switch with the bridge link type and enslave cards to it:

$ ip link add br0 type bridge
$ ip link set eth0 master br0
$ bridge link show
3: eth0: ... master br0 state forwarding priority 32 cost 2

The MAC address table is the forwarding database, bridge fdb. After alice pings bob, the switch has learned both from the frames' source addresses:

$ bridge fdb show br br0 dynamic
1a:2b:3c:00:00:0a dev alice master br0
1a:2b:3c:00:00:0b dev bob master br0

bridge -s fdb adds timers; aging counts from updated, seconds since a frame last came from that address. ip -d link show br0 prints the aging time (in hundredths of a second) and the learned-entry counters:

$ ip -d link show br0
... bridge ... ageing_time 2000 ... fdb_n_learned 2 fdb_max_learned 16

A VLAN-aware bridge filters by tag, and bridge vlan show lists each port's VLANs. Flush the whole table with ip link set br0 type bridge fdb_flush.

What goes wrong, and how you see it

A port is not forwarding. bridge link show shows state disabled or blocking instead of forwarding, and nothing crosses it. A down member card or spanning tree blocking a loop is the usual cause.

One device sees another's traffic. Flooding is normal for unknown or broadcast frames, so a capture on carol catching a frame addressed to bob is expected until the switch has learned bob. If it never stops, the table is not learning.

The table is full and the switch floods everything. With a fixed table size (16 in the lab), an attacker sends frames from thousands of made-up MACs until fdb_n_learned hits fdb_max_learned; real addresses can no longer be learned, so every frame is flooded and the switch behaves like a hub. This is MAC flooding, and port security is the defence.

No connectivity through the switch, but pings to its address work. The management address on br0 answers while forwarding is broken; do not confuse the switch's own address with its forwarding. The switching lab and MAC address table page show each case.

Questions people ask

Is a Linux bridge a real switch? Yes. ip link add type bridge creates a software switch that learns, floods, ages and (with VLAN filtering) tags exactly as a hardware switch does; it is what the labs run.

Switch vs router? A switch forwards by MAC within one network and is invisible at layer 3; a router forwards by IP between networks and is a hop you send frames to. Traffic between VLANs goes through a router.

Switch vs hub? A hub repeats every frame out every port with no table, so everyone hears everything; a switch learns and sends each frame only where it belongs. See ARP and MAC addresses.

See it on real machines