Broadcast Domains Explained for CCNA
Learn how Ethernet broadcasts work, how switches, VLANs, routers, and Layer 3 switches define broadcast domains, and how to count and troubleshoot them for the CCNA.
A broadcast domain is the group of interfaces that can receive a Layer 2 broadcast frame sent by a member of the same Layer 2 segment or VLAN. Broadcast domains are logical boundaries: devices may be physically close together or spread across multiple switches, but they belong to the same broadcast domain when Layer 2 connectivity and VLAN membership allow the broadcast to reach them.
Ethernet uses broadcasts for local discovery and control functions. IPv4 Address Resolution Protocol (ARP), for example, commonly uses a broadcast request to ask which device owns an IPv4 address. The important question is not simply how many cables or switch ports exist, but where Layer 2 forwarding stops and Layer 3 routing begins.
This lesson assumes familiarity with Ethernet frames, MAC addresses, the OSI model, IPv4 addressing, basic switching, and default gateways. For a broader model review, see OSI Reference Model.
What Is a Broadcast Domain?
An Ethernet broadcast is a frame addressed to the destination MAC address FF:FF:FF:FF:FF:FF. Every compatible interface in the local Layer 2 broadcast domain is a potential receiver.
When a switch receives a broadcast frame, it floods the frame out applicable ports in the same VLAN, except the port on which the frame arrived. Receiving hosts process the frame far enough to determine whether the upper-layer content applies to them. A host may then discard the frame if it is not the intended logical recipient.
Broadcasts are normally limited to the local Layer 2 network. A router does not normally forward an Ethernet broadcast from one IP subnet to another. This is why routers and Layer 3 interfaces form broadcast-domain boundaries.
How Ethernet Broadcasts Propagate
- A host creates an Ethernet frame with destination MAC
FF:FF:FF:FF:FF:FF. - The first switch receives the frame and identifies the ingress VLAN.
- The switch floods the frame through other forwarding ports belonging to that VLAN.
- An 802.1Q trunk can carry the broadcast to another switch if the VLAN is active and allowed on the trunk.
- Switches continue flooding the frame within that VLAN, but the frame stops at a Layer 3 interface or another Layer 2 boundary.
A broadcast does not mean that every device everywhere receives the frame. It means every applicable device in the same local broadcast domain can receive it. A switch does not flood a VLAN 10 broadcast into VLAN 20, and a router does not ordinarily forward it to another routed interface.
Broadcast Domains and Collision Domains
A collision domain is a network segment where simultaneous Ethernet transmissions could collide. This concept was especially important with shared-media Ethernet and half-duplex operation. Modern switched Ethernet normally uses full-duplex links, so normal collisions do not occur on those links.
A switch separates collision domains but does not automatically separate broadcast domains. A single switch with all ports in one VLAN has many switch-port collision domains but one broadcast domain.
How Network Devices Affect Broadcast Domains
VLANs Create Broadcast-Domain Boundaries
A VLAN is a logical Layer 2 network segment implemented on switching infrastructure. Each VLAN is normally a separate broadcast domain, even when several VLANs use the same physical switch.
An access port carries traffic for one assigned VLAN and is commonly used for an end device. A trunk port carries traffic for multiple VLANs, usually using IEEE 802.1Q tags. The tag identifies the VLAN as the frame crosses the trunk.
A VLAN can span multiple switches. If VLAN 10 exists on two switches and an 802.1Q trunk allows VLAN 10, the two switches can participate in one VLAN 10 broadcast domain. Physical separation between switches does not automatically create two broadcast domains.
Hosts in different VLANs require inter-VLAN routing, which is Layer 3 forwarding between separate VLANs and their associated IP subnets.
Example: Two VLANs on One Switch
Suppose PC-A and PC-B use VLAN 10 access ports, while PC-C and PC-D use VLAN 20 access ports. A broadcast from PC-A reaches PC-B but not PC-C or PC-D. VLAN 10 and VLAN 20 are two distinct broadcast domains. Communication between them requires a router or multilayer switch.
Example: One VLAN Across Two Switches
Suppose VLAN 10 is active on two switches connected by a trunk. A VLAN 10 broadcast can cross that trunk only when VLAN 10 is allowed and active on the trunk. The broadcast domain therefore spans both switches, although it remains limited to VLAN 10.
Broadcast Domains and IP Subnets
A VLAN is a Layer 2 construct. An IP subnet is a Layer 3 addressing construct. They are different concepts, but a common and practical design uses one VLAN and one IPv4 subnet per broadcast domain.
Aligning VLANs and subnets makes routing, address planning, troubleshooting, and security policy easier. For example, VLAN 10 might use 192.168.10.0/24, while VLAN 20 uses 192.168.20.0/24. Each subnet has a gateway interface in its corresponding VLAN.
A default gateway is the local router or Layer 3 switch interface a host uses to reach destinations outside its local subnet and broadcast domain. If a destination is remote, the host sends the Ethernet frame to the gateway's MAC address. The router or Layer 3 switch then routes the packet toward the remote network.
ARP and Broadcast Traffic
Address Resolution Protocol (ARP) maps an IPv4 address to a local destination MAC address. ARP requests are usually sent as Ethernet broadcasts because the sender does not yet know which interface owns the target IPv4 address.
- The host decides whether the destination is on-link or off-link by comparing the destination address with its own address and subnet mask.
- The host checks its ARP cache for the required MAC address.
- If no usable entry exists, the host sends an ARP request as a local Ethernet broadcast.
- The device owning the IPv4 address sends an ARP reply, normally as a unicast frame.
- The sender stores the mapping temporarily and uses it for subsequent frames.
For an on-subnet destination, the host resolves the remote host's MAC address. For an off-subnet destination, the host resolves the default gateway's MAC address, not the remote host's MAC address. The IP packet still contains the remote destination IP address, but the local Ethernet frame is addressed to the gateway.
IPv6 generally uses multicast-based Neighbor Discovery rather than ARP broadcasts. Do not assume that every discovery protocol uses Ethernet broadcast or that every traffic type called broadcast is handled identically by every device.
Broadcast Scope and Routing Behavior
Several terms describe different broadcast concepts:
- Layer 2 Ethernet broadcast: An Ethernet frame addressed to
FF:FF:FF:FF:FF:FF, flooded within the local VLAN. - Limited IPv4 broadcast: The IPv4 address
255.255.255.255, meaning the local network segment. Routers generally do not forward it. - Directed broadcast: An IPv4 broadcast addressed to the broadcast address of a specific remote subnet, such as the last address in a subnet. Forwarding is commonly disabled because it can be abused in traffic-amplification attacks and is not normal user-network behavior.
Protocol behavior varies. A routed application relay, multicast transmission, or unknown-unicast flood should not automatically be treated as the same thing as an Ethernet broadcast.
Cisco IOS VLAN and Trunk Examples
The following example creates VLANs and assigns access ports. Interface ranges and commands can vary slightly by platform.
vlan 10
name USERS
vlan 20
name SERVERS
interface range gigabitEthernet 0/1-2
switchport mode access
switchport access vlan 10
interface range gigabitEthernet 0/3-4
switchport mode access
switchport access vlan 20An 802.1Q trunk between switches can carry both VLANs:
interface gigabitEthernet 0/24
switchport mode trunk
switchport trunk allowed vlan 10,20Useful verification commands include:
show vlan brief
show interfaces switchport
show interfaces trunk
show mac address-table dynamic
show interfaces statusInter-VLAN Routing
SVIs on a Multilayer Switch
An SVI, or Switched Virtual Interface, is a virtual Layer 3 interface associated with a VLAN. A multilayer switch can route between VLANs using SVIs:
ip routing
interface vlan 10
ip address 192.168.10.1 255.255.255.0
no shutdown
interface vlan 20
ip address 192.168.20.1 255.255.255.0
no shutdownHosts in VLAN 10 use 192.168.10.1 as their default gateway, and hosts in VLAN 20 use 192.168.20.1. Broadcasts remain inside their originating VLAN; routed unicast traffic can cross between the VLANs when routing and policy permit it.
Router-on-a-Stick
Router-on-a-stick uses one router physical interface with multiple VLAN-tagged subinterfaces:
interface gigabitEthernet 0/0
no shutdown
interface gigabitEthernet 0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface gigabitEthernet 0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0The switch link to the router must be configured to carry the required VLANs. Each router subinterface represents a separate Layer 3 interface and broadcast-domain boundary.
Counting Broadcast Domains in Topologies
Use this repeatable method in diagrams and CCNA questions:
- List every VLAN or routed Layer 3 segment.
- Assign each access port to its VLAN.
- Trace Layer 2 continuity across bridges, switches, and trunks.
- Confirm which VLANs are actually active and allowed on each trunk.
- Stop the Layer 2 trace at a router interface, SVI, routed switch port, or firewall interface that is routing between networks.
- Count each distinct Layer 2 broadcast scope once.
For example, if a hub connects three hosts to one switch access port, those hosts remain in the access port's VLAN. If the switch has VLAN 10 and VLAN 20 plus a routed uplink, the two local VLANs are two broadcast domains, while the routed network beyond the uplink is another Layer 3 broadcast domain.
Network Design and Broadcast Storms
Large broadcast domains can consume link bandwidth and host CPU resources. Every broadcast must be flooded through the relevant Layer 2 topology, and many hosts must inspect the frame. Excessive broadcasts can reduce useful throughput and increase processing load.
A broadcast storm is excessive broadcast traffic, often caused by a Layer 2 loop or faulty device. Symptoms can include high link utilization, high switch CPU load, packet loss, slow management access, MAC-table instability, and general network instability.
Spanning Tree Protocol is the primary mechanism for preventing Layer 2 loops. Storm control is a containment feature that limits broadcast, multicast, or unknown-unicast traffic when it exceeds a configured threshold. Storm control is not a replacement for correct loop prevention.
interface gigabitEthernet 0/10
storm-control broadcast level 1.00 0.50
storm-control action shutdownThreshold syntax and supported actions vary by Cisco platform and software release. Verify the platform documentation before deploying this configuration.
More VLANs reduce the size of each broadcast domain, but they also require additional subnet planning, gateway interfaces, routing, monitoring, and operational management. Segmentation is a design tradeoff rather than a goal to maximize without limit.
Troubleshooting Broadcast-Domain Problems
Hosts Expected to Share a VLAN Cannot Discover Each Other
- Check whether the access ports are assigned to the same VLAN.
- Confirm that the VLAN exists and is active.
- Verify that the trunk is actually operating as a trunk.
- Confirm that the VLAN is allowed across every required trunk.
- Check whether a port is administratively down or blocked.
show vlan brief
show interfaces switchport
show interfaces trunkDevices in Different VLANs Appear to Exchange Broadcasts
First verify that the traffic is truly a Layer 2 broadcast. Inspect the destination MAC address and VLAN tag with a packet capture. Also check for incorrect port assignments, unauthorized bridging, virtual-switch configuration, multicast, routed traffic, or an application relay that may look like broadcast behavior.
Separate VLANs Cannot Communicate After Routing Was Configured
- Inspect SVI or router subinterface state with
show ip interface brief. - Verify gateway IP addresses and subnet masks.
- Check the hosts' default gateways.
- Confirm that the required VLAN exists and is allowed to the router or multilayer switch.
- Check ACLs and firewall policy.
- Test each host's local gateway before testing a remote destination.
Broadcast Traffic Causes Severe Performance Problems
Check for a Layer 2 loop, Spanning Tree failures, topology changes, faulty devices, and unusually high interface broadcast counters. Locate recently changed links or devices and isolate suspected segments according to operational procedures. Use storm control as a protective limit after addressing the underlying cause.
A Host Cannot Reach a Local IPv4 Peer
Inspect ARP entries, switch MAC-address learning, endpoint interface state, VLAN membership, duplicate addresses, port-security behavior, and endpoint firewalls. Useful IOS commands include:
show ip arp
show mac address-table dynamic
show ip interface briefExam-Relevant Summary
- A broadcast domain is the set of interfaces that can receive a Layer 2 broadcast from another member.
- The Ethernet broadcast destination MAC address is
FF:FF:FF:FF:FF:FF. - A Layer 2 switch floods broadcasts within the same VLAN, except out the ingress port.
- A switch separates collision domains per port but does not create separate broadcast domains unless VLANs are used.
- Each VLAN is normally one broadcast domain.
- A trunk can extend the same VLAN and its broadcast domain across multiple switches.
- Routers and routed Layer 3 interfaces stop ordinary Layer 2 broadcasts.
- Hosts in different VLANs need inter-VLAN routing to communicate.
- For off-subnet traffic, ARP resolves the default gateway MAC address.
- Count broadcast domains by VLAN and routed boundaries, not by host count or switch-port count.
Broadcast domains are a foundation for understanding VLANs, subnetting, inter-VLAN routing, ARP, and Layer 2 loop behavior. For related networking fundamentals, see Computer Network Expained.