CCNA online course

Broadcast Domains Explained for CCNA

Learn how Ethernet broadcasts work, how switches, VLANs, routers, and Layer 3 switches define broadcast domains, and how to count and troubleshoot them for the CCNA.

A broadcast domain is the group of interfaces that can receive a Layer 2 broadcast frame sent by a member of the same Layer 2 segment or VLAN. Broadcast domains are logical boundaries: devices may be physically close together or spread across multiple switches, but they belong to the same broadcast domain when Layer 2 connectivity and VLAN membership allow the broadcast to reach them.

Ethernet uses broadcasts for local discovery and control functions. IPv4 Address Resolution Protocol (ARP), for example, commonly uses a broadcast request to ask which device owns an IPv4 address. The important question is not simply how many cables or switch ports exist, but where Layer 2 forwarding stops and Layer 3 routing begins.

This lesson assumes familiarity with Ethernet frames, MAC addresses, the OSI model, IPv4 addressing, basic switching, and default gateways. For a broader model review, see OSI Reference Model.

What Is a Broadcast Domain?

An Ethernet broadcast is a frame addressed to the destination MAC address FF:FF:FF:FF:FF:FF. Every compatible interface in the local Layer 2 broadcast domain is a potential receiver.

When a switch receives a broadcast frame, it floods the frame out applicable ports in the same VLAN, except the port on which the frame arrived. Receiving hosts process the frame far enough to determine whether the upper-layer content applies to them. A host may then discard the frame if it is not the intended logical recipient.

Broadcasts are normally limited to the local Layer 2 network. A router does not normally forward an Ethernet broadcast from one IP subnet to another. This is why routers and Layer 3 interfaces form broadcast-domain boundaries.

How Ethernet Broadcasts Propagate

  1. A host creates an Ethernet frame with destination MAC FF:FF:FF:FF:FF:FF.
  2. The first switch receives the frame and identifies the ingress VLAN.
  3. The switch floods the frame through other forwarding ports belonging to that VLAN.
  4. An 802.1Q trunk can carry the broadcast to another switch if the VLAN is active and allowed on the trunk.
  5. Switches continue flooding the frame within that VLAN, but the frame stops at a Layer 3 interface or another Layer 2 boundary.

A broadcast does not mean that every device everywhere receives the frame. It means every applicable device in the same local broadcast domain can receive it. A switch does not flood a VLAN 10 broadcast into VLAN 20, and a router does not ordinarily forward it to another routed interface.

Broadcast Domains and Collision Domains

A collision domain is a network segment where simultaneous Ethernet transmissions could collide. This concept was especially important with shared-media Ethernet and half-duplex operation. Modern switched Ethernet normally uses full-duplex links, so normal collisions do not occur on those links.

Broadcast Domain and Collision Domain Comparison

What is affected: Broadcast domain — recipients of Layer 2 broadcasts. Collision domain — devices that could contend for the same shared transmission medium.

Relevant traffic: Broadcast domain — broadcast frames. Collision domain — simultaneous Ethernet transmissions.

Typical boundary device: Broadcast domain — router, Layer 3 interface, or VLAN boundary. Collision domain — a switch port or a physical separation from shared media.

Effect of a switch: Broadcasts remain together by default in one VLAN, while each switch port is a separate collision domain.

Effect of a router: Broadcasts stop at the router interface, and each interface belongs to a different Layer 3 network.

Modern Ethernet relevance: Broadcast domains remain important. Collision domains are mostly a historical and conceptual topic on full-duplex switched networks.

A switch separates collision domains but does not automatically separate broadcast domains. A single switch with all ports in one VLAN has many switch-port collision domains but one broadcast domain.

How Network Devices Affect Broadcast Domains

How Common Network Devices Handle Broadcast Domains

Hub: Repeats incoming signals to all other ports. It does not inspect VLANs or create a broadcast boundary. All attached devices share one broadcast domain and one shared collision domain.

Layer 2 switch: Floods broadcasts within the receiving VLAN, excluding the ingress port. Ports in the same VLAN share a broadcast domain; each switch port is normally its own collision domain.

Bridge: Behaves similarly to a Layer 2 switch. It forwards or floods frames at Layer 2 and does not normally separate broadcasts unless logical segmentation is configured.

Router: Does not forward ordinary Layer 2 broadcasts between interfaces. Each routed interface terminates one broadcast domain.

Layer 3 switch: Switches within VLANs and routes between VLANs. Each VLAN is a separate broadcast domain, and an SVI or routed interface provides the Layer 3 boundary.

Firewall: Can form a Layer 3 boundary when routing between interfaces or security zones. Policy may permit, deny, or selectively relay some traffic, so its behavior depends on its configuration.

VLANs Create Broadcast-Domain Boundaries

A VLAN is a logical Layer 2 network segment implemented on switching infrastructure. Each VLAN is normally a separate broadcast domain, even when several VLANs use the same physical switch.

An access port carries traffic for one assigned VLAN and is commonly used for an end device. A trunk port carries traffic for multiple VLANs, usually using IEEE 802.1Q tags. The tag identifies the VLAN as the frame crosses the trunk.

A VLAN can span multiple switches. If VLAN 10 exists on two switches and an 802.1Q trunk allows VLAN 10, the two switches can participate in one VLAN 10 broadcast domain. Physical separation between switches does not automatically create two broadcast domains.

Hosts in different VLANs require inter-VLAN routing, which is Layer 3 forwarding between separate VLANs and their associated IP subnets.

Example: Two VLANs on One Switch

Suppose PC-A and PC-B use VLAN 10 access ports, while PC-C and PC-D use VLAN 20 access ports. A broadcast from PC-A reaches PC-B but not PC-C or PC-D. VLAN 10 and VLAN 20 are two distinct broadcast domains. Communication between them requires a router or multilayer switch.

Example: One VLAN Across Two Switches

Suppose VLAN 10 is active on two switches connected by a trunk. A VLAN 10 broadcast can cross that trunk only when VLAN 10 is allowed and active on the trunk. The broadcast domain therefore spans both switches, although it remains limited to VLAN 10.

Broadcast Domains and IP Subnets

A VLAN is a Layer 2 construct. An IP subnet is a Layer 3 addressing construct. They are different concepts, but a common and practical design uses one VLAN and one IPv4 subnet per broadcast domain.

Aligning VLANs and subnets makes routing, address planning, troubleshooting, and security policy easier. For example, VLAN 10 might use 192.168.10.0/24, while VLAN 20 uses 192.168.20.0/24. Each subnet has a gateway interface in its corresponding VLAN.

A default gateway is the local router or Layer 3 switch interface a host uses to reach destinations outside its local subnet and broadcast domain. If a destination is remote, the host sends the Ethernet frame to the gateway's MAC address. The router or Layer 3 switch then routes the packet toward the remote network.

ARP and Broadcast Traffic

Address Resolution Protocol (ARP) maps an IPv4 address to a local destination MAC address. ARP requests are usually sent as Ethernet broadcasts because the sender does not yet know which interface owns the target IPv4 address.

  1. The host decides whether the destination is on-link or off-link by comparing the destination address with its own address and subnet mask.
  2. The host checks its ARP cache for the required MAC address.
  3. If no usable entry exists, the host sends an ARP request as a local Ethernet broadcast.
  4. The device owning the IPv4 address sends an ARP reply, normally as a unicast frame.
  5. The sender stores the mapping temporarily and uses it for subsequent frames.

For an on-subnet destination, the host resolves the remote host's MAC address. For an off-subnet destination, the host resolves the default gateway's MAC address, not the remote host's MAC address. The IP packet still contains the remote destination IP address, but the local Ethernet frame is addressed to the gateway.

IPv6 generally uses multicast-based Neighbor Discovery rather than ARP broadcasts. Do not assume that every discovery protocol uses Ethernet broadcast or that every traffic type called broadcast is handled identically by every device.

Broadcast Scope and Routing Behavior

Several terms describe different broadcast concepts:

  • Layer 2 Ethernet broadcast: An Ethernet frame addressed to FF:FF:FF:FF:FF:FF, flooded within the local VLAN.
  • Limited IPv4 broadcast: The IPv4 address 255.255.255.255, meaning the local network segment. Routers generally do not forward it.
  • Directed broadcast: An IPv4 broadcast addressed to the broadcast address of a specific remote subnet, such as the last address in a subnet. Forwarding is commonly disabled because it can be abused in traffic-amplification attacks and is not normal user-network behavior.

Protocol behavior varies. A routed application relay, multicast transmission, or unknown-unicast flood should not automatically be treated as the same thing as an Ethernet broadcast.

Cisco IOS VLAN and Trunk Examples

The following example creates VLANs and assigns access ports. Interface ranges and commands can vary slightly by platform.

vlan 10
 name USERS
vlan 20
 name SERVERS
interface range gigabitEthernet 0/1-2
 switchport mode access
 switchport access vlan 10
interface range gigabitEthernet 0/3-4
 switchport mode access
 switchport access vlan 20

An 802.1Q trunk between switches can carry both VLANs:

interface gigabitEthernet 0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20

Useful verification commands include:

show vlan brief
show interfaces switchport
show interfaces trunk
show mac address-table dynamic
show interfaces status

Inter-VLAN Routing

SVIs on a Multilayer Switch

An SVI, or Switched Virtual Interface, is a virtual Layer 3 interface associated with a VLAN. A multilayer switch can route between VLANs using SVIs:

ip routing
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown
interface vlan 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown

Hosts in VLAN 10 use 192.168.10.1 as their default gateway, and hosts in VLAN 20 use 192.168.20.1. Broadcasts remain inside their originating VLAN; routed unicast traffic can cross between the VLANs when routing and policy permit it.

Router-on-a-Stick

Router-on-a-stick uses one router physical interface with multiple VLAN-tagged subinterfaces:

interface gigabitEthernet 0/0
 no shutdown
interface gigabitEthernet 0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface gigabitEthernet 0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

The switch link to the router must be configured to carry the required VLANs. Each router subinterface represents a separate Layer 3 interface and broadcast-domain boundary.

Counting Broadcast Domains in Topologies

Use this repeatable method in diagrams and CCNA questions:

  1. List every VLAN or routed Layer 3 segment.
  2. Assign each access port to its VLAN.
  3. Trace Layer 2 continuity across bridges, switches, and trunks.
  4. Confirm which VLANs are actually active and allowed on each trunk.
  5. Stop the Layer 2 trace at a router interface, SVI, routed switch port, or firewall interface that is routing between networks.
  6. Count each distinct Layer 2 broadcast scope once.
Example Topologies and Broadcast-Domain Counts

One switch, one VLAN — Count: 1. All connected switch ports participate in the same default VLAN.

One switch, two VLANs — Count: 2. Each VLAN is a separate Layer 2 broadcast domain.

Two switches connected by a trunk carrying one VLAN — Count: 1. The allowed VLAN extends across the trunk.

Two switches connected by a trunk carrying two VLANs — Count: 2. Each VLAN forms its own continuous broadcast scope across both switches.

Router with two LAN interfaces — Count: 2. Each routed interface terminates one LAN broadcast domain.

Hub connected to a switch access port — Count: 1 for the VLAN. The hub adds shared media and a shared collision domain, but it does not create a new broadcast domain.

For example, if a hub connects three hosts to one switch access port, those hosts remain in the access port's VLAN. If the switch has VLAN 10 and VLAN 20 plus a routed uplink, the two local VLANs are two broadcast domains, while the routed network beyond the uplink is another Layer 3 broadcast domain.

Network Design and Broadcast Storms

Large broadcast domains can consume link bandwidth and host CPU resources. Every broadcast must be flooded through the relevant Layer 2 topology, and many hosts must inspect the frame. Excessive broadcasts can reduce useful throughput and increase processing load.

A broadcast storm is excessive broadcast traffic, often caused by a Layer 2 loop or faulty device. Symptoms can include high link utilization, high switch CPU load, packet loss, slow management access, MAC-table instability, and general network instability.

Spanning Tree Protocol is the primary mechanism for preventing Layer 2 loops. Storm control is a containment feature that limits broadcast, multicast, or unknown-unicast traffic when it exceeds a configured threshold. Storm control is not a replacement for correct loop prevention.

interface gigabitEthernet 0/10
 storm-control broadcast level 1.00 0.50
 storm-control action shutdown

Threshold syntax and supported actions vary by Cisco platform and software release. Verify the platform documentation before deploying this configuration.

More VLANs reduce the size of each broadcast domain, but they also require additional subnet planning, gateway interfaces, routing, monitoring, and operational management. Segmentation is a design tradeoff rather than a goal to maximize without limit.

Troubleshooting Broadcast-Domain Problems

Hosts Expected to Share a VLAN Cannot Discover Each Other

  • Check whether the access ports are assigned to the same VLAN.
  • Confirm that the VLAN exists and is active.
  • Verify that the trunk is actually operating as a trunk.
  • Confirm that the VLAN is allowed across every required trunk.
  • Check whether a port is administratively down or blocked.
show vlan brief
show interfaces switchport
show interfaces trunk

Devices in Different VLANs Appear to Exchange Broadcasts

First verify that the traffic is truly a Layer 2 broadcast. Inspect the destination MAC address and VLAN tag with a packet capture. Also check for incorrect port assignments, unauthorized bridging, virtual-switch configuration, multicast, routed traffic, or an application relay that may look like broadcast behavior.

Separate VLANs Cannot Communicate After Routing Was Configured

  • Inspect SVI or router subinterface state with show ip interface brief.
  • Verify gateway IP addresses and subnet masks.
  • Check the hosts' default gateways.
  • Confirm that the required VLAN exists and is allowed to the router or multilayer switch.
  • Check ACLs and firewall policy.
  • Test each host's local gateway before testing a remote destination.

Broadcast Traffic Causes Severe Performance Problems

Check for a Layer 2 loop, Spanning Tree failures, topology changes, faulty devices, and unusually high interface broadcast counters. Locate recently changed links or devices and isolate suspected segments according to operational procedures. Use storm control as a protective limit after addressing the underlying cause.

A Host Cannot Reach a Local IPv4 Peer

Inspect ARP entries, switch MAC-address learning, endpoint interface state, VLAN membership, duplicate addresses, port-security behavior, and endpoint firewalls. Useful IOS commands include:

show ip arp
show mac address-table dynamic
show ip interface brief

Exam-Relevant Summary

  • A broadcast domain is the set of interfaces that can receive a Layer 2 broadcast from another member.
  • The Ethernet broadcast destination MAC address is FF:FF:FF:FF:FF:FF.
  • A Layer 2 switch floods broadcasts within the same VLAN, except out the ingress port.
  • A switch separates collision domains per port but does not create separate broadcast domains unless VLANs are used.
  • Each VLAN is normally one broadcast domain.
  • A trunk can extend the same VLAN and its broadcast domain across multiple switches.
  • Routers and routed Layer 3 interfaces stop ordinary Layer 2 broadcasts.
  • Hosts in different VLANs need inter-VLAN routing to communicate.
  • For off-subnet traffic, ARP resolves the default gateway MAC address.
  • Count broadcast domains by VLAN and routed boundaries, not by host count or switch-port count.

Broadcast domains are a foundation for understanding VLANs, subnetting, inter-VLAN routing, ARP, and Layer 2 loop behavior. For related networking fundamentals, see Computer Network Expained.