CCNA online course

Differences Between Network Switches and Bridges

Learn how Ethernet bridges and switches forward frames, learn MAC addresses, separate collision domains, handle VLANs and broadcasts, and use STP to prevent Layer 2 loops.

A bridge and a switch are Layer 2 Ethernet devices. Both examine Ethernet frame headers and use MAC addresses to decide whether a frame should be forwarded, filtered, or flooded. The main practical difference is that a traditional bridge usually connects a small number of LAN segments, while a switch is a high-port-density, high-performance multiport bridge.

Switches largely replaced standalone bridges in wired LANs, but the bridge concept remains important. Spanning Tree Protocol (STP), wireless bridging, Linux bridge interfaces, and virtual networking all use the same fundamental Layer 2 ideas.

Prerequisites and key terms

An Ethernet frame carries a source MAC address and a destination MAC address. A MAC address identifies a network interface at Layer 2. A switch or bridge uses these addresses rather than IP addresses when making its basic forwarding decision.

• MAC address table: A table that maps learned MAC addresses to ports. It is also called a forwarding database.
• CAM table: A hardware-oriented name for the table used by many switches to find an outgoing port quickly.
• Collision domain: A segment where simultaneous half-duplex Ethernet transmissions could collide.
• Broadcast domain: The set of devices that receive a Layer 2 broadcast.
• Flooding: Sending a frame through all eligible ports except the port where it arrived.
• Filtering: Not forwarding a frame because the destination is known to be reachable through the incoming port.
• Known unicast: A unicast frame whose destination MAC address is present in the MAC table.
• Unknown unicast: A unicast frame whose destination MAC address is not currently in the MAC table.

For a review of how Layer 2 fits into the complete networking model, see the OSI Reference Model.

Why use bridges and switches?

Layer 2 devices connect Ethernet segments while making forwarding more selective than a hub or repeater. A repeater copies electrical or optical signals, and a hub repeats incoming bits to every other port. A bridge or switch instead examines the frame and can send it only where it needs to go.

• They extend a LAN beyond the length or port limitations of one segment.
• They reduce unnecessary traffic by forwarding known unicast frames selectively.
• They separate collision domains, allowing connected segments to transmit independently.
• They preserve the same Layer 2 network when routing between IP networks is not required.
• They can divide one physical switching platform into multiple logical LANs using VLANs.

A bridge or Layer 2 switch does not inherently separate IP networks. If devices remain in the same VLAN, broadcasts such as ARP requests normally cross the device. Communication between different IP subnets requires a router or a Layer 3 switch.

How a traditional network bridge works

A traditional bridge connects two or a small number of Ethernet segments. Two-port bridges were especially common as a way to join separate segments while preventing every frame from crossing the connection.

When a frame arrives, the bridge performs four basic actions:

1. It reads the source MAC address and records that address against the incoming port.
2. It looks up the destination MAC address in its forwarding table.
3. If the destination is known on another port, it forwards the frame through that port.
4. If the destination is unknown or the frame is a broadcast, it floods the frame through eligible other ports.

If the destination MAC is known to be on the same port where the frame arrived, the bridge filters the frame. There is no reason to send it back onto the same segment.

Bridge example

Assume a two-port bridge joins Segment 1 and Segment 2. Host A on Segment 1 sends a frame to Host B on Segment 2. The bridge first learns Host A's MAC address on its Segment 1 port. If Host B is not in the table, the bridge floods the frame to Segment 2. When Host B later sends a frame, the bridge learns Host B's MAC address on Segment 2. Future A-to-B frames can then be forwarded only to Segment 2.

This learning process does not require a central configuration of every host. The bridge observes the source address of frames that arrive naturally.

Collision and broadcast behavior of a bridge

A bridge separates collision domains. Each attached segment is a separate collision domain, especially when an attached segment uses half-duplex Ethernet. A collision on one segment is not propagated as an Ethernet collision into the other segment.

However, a bridge does not inherently separate broadcast domains. A broadcast frame is normally forwarded to the other bridged segment. All devices connected through the bridge remain in the same Layer 2 broadcast domain unless another mechanism, such as VLAN separation or routing, is introduced.

How a network switch works

A switch is a multiport Layer 2 bridge. It applies the same source-learning and destination-lookup logic as a bridge, but it usually has many physical ports and is designed for high-speed forwarding.

In a typical office switch, each workstation connects to a separate port. The switch learns which MAC addresses are reachable through those ports. Once the table is populated, traffic between two workstations is sent only between the relevant ports rather than to every port.

• Each switch port normally represents a separate collision domain.
• Modern switched Ethernet links normally operate full duplex.
• Full duplex permits sending and receiving at the same time on a point-to-point link, so collisions do not occur on that link.
• A switch can support many endpoints, VLANs, trunks, monitoring functions, and security controls.
• Managed switches provide operational visibility and configuration options that traditional bridges generally lacked.

Switches are commonly deployed at the LAN access layer, where end-user devices, printers, phones, access points, and servers connect to the network.

MAC learning and frame-forwarding decisions

The forwarding process is local to a bridge or switch and normally occurs for each frame.

Step 1: Learn the source

When a frame arrives on an interface, the device records the source MAC address and the incoming interface. For example, if a frame sourced by 00:11:22:33:44:55 arrives on port 3, the table can associate that address with port 3.

If the same MAC address later appears on another port, the table is updated. Rapid movement between ports is called MAC flapping and may indicate a loop, a misconnected device, or a virtual machine moving between interfaces.

Step 2: Look up the destination

The device searches its MAC address table for the destination MAC address. The result determines whether the frame is forwarded, flooded, or filtered.

Step 3: Age old entries

MAC table entries are dynamic and normally age out after a period without traffic. Aging prevents an old location from remaining valid after a device is unplugged or moved. The exact aging timer depends on the platform and configuration.

Unknown-unicast flooding is normal when a destination has not yet been learned or when its entry has aged out. It becomes a troubleshooting concern when flooding is excessive or continues because of a loop or unstable topology.

Switches versus bridges: core differences

The distinction is partly historical and partly practical. A switch is not a fundamentally different forwarding concept from a bridge; it is a many-port implementation with modern hardware, density, and management capabilities.

Collision domains and broadcast domains

These two terms describe different boundaries.

• A collision domain concerns simultaneous Ethernet transmissions on a shared or half-duplex segment.
• A broadcast domain concerns which devices receive a Layer 2 broadcast.

VLANs and broadcast domains

A VLAN is a logical Layer 2 network. A switch can place some ports in VLAN 10 and other ports in VLAN 20. Broadcasts arriving in VLAN 10 are delivered to ports in VLAN 10, not to ports assigned only to VLAN 20.

VLANs therefore create separate broadcast domains on one physical switch. They do not automatically provide communication between those domains. A router or Layer 3 switch must perform inter-VLAN routing.

For example, four PCs connect to one switch. PCs 1 and 2 are in VLAN 10, while PCs 3 and 4 are in VLAN 20. An ARP broadcast from PC 1 reaches PC 2 but not PCs 3 and 4. If PC 1 must communicate with PC 3, the network needs a Layer 3 gateway for both VLANs.

Broadcast, multicast, and unknown-unicast flooding

Bridges and switches forward broadcasts by default because a broadcast is intended for all devices in the local Layer 2 domain. An ARP request is a common example.

An unknown unicast is flooded because the device does not yet know which port leads to the destination. The incoming port is excluded to prevent the frame from immediately returning to the segment where it arrived.

Multicast treatment varies. A simple switch may flood multicast within the VLAN. Features such as IGMP snooping can allow a managed switch to forward certain IP multicast frames only to ports with interested receivers. This does not change the basic bridge concept: forwarding depends on Layer 2 information and configured state.

Loop prevention with Spanning Tree Protocol

Redundant Layer 2 links improve availability, but they can create a loop. Consider two switches connected by two physical links. A broadcast sent into the topology could circulate around both links indefinitely because Layer 2 frames do not contain a general hop-count field like an IP packet's TTL.

Layer 2 loops can cause:

• Broadcast storms that consume link bandwidth and switch resources.
• Duplicate copies of frames arriving at endpoints.
• MAC table instability, where one source MAC repeatedly appears on different ports.
• High interface utilization and severe network performance problems.

Spanning Tree Protocol (STP) prevents these loops by selecting a loop-free logical topology. It places one or more redundant paths into a blocking or alternate state while keeping those paths available for recovery if the active path fails.

STP-capable bridges and switches exchange Bridge Protocol Data Units (BPDUs). BPDUs carry information used to select a root bridge and determine the preferred paths toward that root. STP applies to both traditional bridged networks and modern switched Ethernet networks. Faster variants, such as Rapid STP, improve convergence but use the same general loop-prevention purpose.

Store-and-forward and other switching methods

Store and forward

A traditional bridge commonly receives the complete Ethernet frame before forwarding it. Modern switches also frequently use store-and-forward switching. The switch can calculate and verify the frame check sequence (FCS), which helps prevent a corrupted frame from being transmitted to another segment.

The trade-off is that the device must receive the entire frame before beginning transmission, adding some latency.

Cut-through switching

Cut-through switching begins forwarding after reading enough of the frame to identify the destination port, often before the complete frame has arrived. This can reduce latency, but a damaged frame may be forwarded because the switch has not yet received the complete frame and checked its FCS.

Fragment-free switching

Fragment-free switching is an intermediate approach. The switch waits for an initial portion of the frame before forwarding. Historically, this helped avoid forwarding many collision fragments while reducing latency compared with full store-and-forward operation.

Managed switch features

Modern managed switches provide much more than basic frame forwarding. Common capabilities include:

• Access-port VLAN assignment and 802.1Q trunking.
• STP, Rapid STP, and related topology protections.
• Port security and restrictions on learned MAC addresses.
• Link aggregation, quality of service, and traffic monitoring.
• Interface counters, logs, diagnostics, and remote management.
• Layer 3 interfaces or routing features on multilayer switch models.

These features, combined with high port density and ASIC-based forwarding, make a managed switch the normal choice when expanding a wired LAN.

Cisco IOS verification commands

The following commands help verify the concepts on a Cisco switch.

show mac address-table
show mac address-table dynamic
show mac address-table interface GigabitEthernet0/1

Use VLAN and trunk commands to check which broadcast domain a port belongs to and whether VLANs cross a link.

show vlan brief
show interfaces trunk
show interfaces GigabitEthernet0/1 switchport

Use STP commands to inspect the root bridge, port roles, and topology state.

show spanning-tree
show spanning-tree vlan 10
show spanning-tree interface GigabitEthernet0/1 detail

Basic access-port VLAN example

configure terminal
vlan 10
name USERS
interface GigabitEthernet0/1
switchport mode access
switchport access vlan 10
end

Basic trunk example

configure terminal
interface GigabitEthernet0/24
switchport mode trunk
switchport trunk allowed vlan 10,20
end

A trunk carries traffic for multiple VLANs between network devices. For a router-on-a-stick design, see Configure Router On A Stick. For additional trunk configuration guidance, see Configure Trunk Ports.

Troubleshooting common Layer 2 problems

A destination cannot be reached even though the links are up

• Check whether the interface is up and not administratively down or err-disabled.
• Inspect the MAC address table to see whether the endpoint's MAC address was learned.
• Confirm that the endpoint is assigned to the correct VLAN.
• Verify that the endpoint has generated traffic; a silent endpoint may not yet appear as a dynamic entry.
• Check whether the destination is actually in another broadcast domain and therefore requires Layer 3 routing.

Performance collapses after adding a redundant link

• Suspect a Layer 2 loop, especially if broadcasts increase sharply.
• Check STP state, root selection, and port roles.
• Look for MAC addresses rapidly changing between interfaces.
• Inspect interface counters for excessive broadcast traffic or errors.
• Check for an unmanaged switch or an accidental cable loop.

Devices in separate VLANs cannot communicate

This may be expected. Verify the access VLAN on each port, confirm that the trunk carries the required VLAN, and check for a router, router-on-a-stick subinterface, or Layer 3 switch SVI. Endpoints must also have correct default gateways.

Traffic expected to be unicast is being flooded

• The destination MAC address may not have been learned yet.
• The dynamic entry may have aged out.
• The endpoint may be offline or connected to a new port.
• A loop may be causing MAC table instability.
• The switch may have a MAC table capacity or hardware issue.

Inspect dynamic entries, generate traffic from the destination, check logs for MAC flapping, and validate the physical and STP topology.

Modern relevance of the bridge term

Dedicated standalone bridges are uncommon in current wired Ethernet networks because switches provide more ports, better performance, and richer management for a similar role. A small modern LAN normally uses a switch rather than a separate two-port bridge.

Bridge functionality still appears in several places:

• Wireless access points may bridge wireless clients to a wired Ethernet VLAN.
• Linux bridge interfaces connect virtual machines or containers to a Layer 2 network.
• Hypervisors and virtual switches perform software-based Layer 2 forwarding.
• STP terminology and standards continue to refer to bridges and bridge ports.
• Specialized network appliances may bridge traffic transparently between interfaces.

Therefore, “bridge” describes the Layer 2 forwarding function, while “switch” usually describes the practical, multiport product used in modern LANs.

Practical decision: bridge or switch?

Choose a modern managed switch when you need to connect multiple endpoints, create VLANs, use trunks, monitor interfaces, apply port security, or build a redundant topology. A traditional bridge may still be encountered in legacy equipment or embedded and virtual networking, but it is rarely the best general-purpose device for expanding a wired office LAN.

Related concepts

Continue with Computer Network Expained for broader networking concepts, or review Configure OSPF to contrast Layer 3 routing with Layer 2 bridging. Cisco IOS device access and configuration basics are covered in Configure Passwords In Ios.