VMware ESXi and vSphere Cluster Management
Differences Between Network Switches and Bridges
Learn how Layer 2 bridges and Ethernet switches compare, including ports, MAC forwarding, collision domains, VLANs, broadcasts, and spanning tree.
A bridge and an Ethernet switch both operate primarily at OSI Layer 2, the data-link layer. They inspect Ethernet frames and use MAC addresses to decide whether to forward, filter, or flood traffic.
The practical distinction is that an Ethernet switch is a multiport bridge. Traditional bridges usually connected two or a few LAN segments, while switches provide many ports and are the standard access device in modern Ethernet networks.
Bridge and Switch Definitions
What is a network bridge?
A network bridge is a Layer 2 device that connects separate Ethernet or LAN segments. It learns the source MAC address of frames and associates each learned address with a bridge port. The resulting table is called a MAC address table, forwarding database, or CAM table.
Using that table, a bridge can forward a frame toward the segment containing its destination, filter traffic that does not need to cross the bridge, and flood traffic when the destination location is unknown.
What is an Ethernet switch?
An Ethernet switch is a multiport Layer 2 bridge. It connects many hosts or network segments and selectively forwards frames between its ports. A small switch may have a few access ports; enterprise switches may provide a high density of copper, fiber, or uplink interfaces.
Both devices commonly perform the same basic operations:
- Learn source MAC addresses from incoming frames.
- Build a forwarding table that maps MAC addresses to ports.
- Forward known unicast frames through the appropriate port.
- Filter a frame when the source and destination are reachable through the same port.
- Flood unknown unicast and broadcast traffic within the applicable Layer 2 domain.
- Flood applicable multicast traffic when no more specific forwarding treatment is available.
Bridge Versus Switch: Main Differences
| Characteristic | Traditional bridge | Ethernet switch | Teaching note |
|---|---|---|---|
| Primary OSI layer | Layer 2 | Layer 2, with some models also supporting Layer 3 features | Basic switching decisions use Ethernet MAC addresses. |
| MAC-address-based forwarding | Yes | Yes | Both learn source addresses and use a forwarding table. |
| Typical port count | Often two or a few interfaces | Many ports, from small access switches to high-density enterprise platforms | More ports allow direct host connections. |
| Typical forwarding implementation | Historically often software-driven | Commonly uses dedicated forwarding hardware such as ASICs | This is a typical implementation difference, not an absolute protocol rule. |
| Typical performance and scalability | Lower on older platforms | Higher throughput and lower forwarding latency on modern platforms | Hardware-assisted forwarding processes frames efficiently. |
| Collision-domain separation | Separates collision domains by port or segment | Normally provides one collision domain per switch port | A hub attached to a port remains one shared collision domain. |
| VLAN support | Depends on the device | Unmanaged switches usually do not; managed switches often do | Do not assume every switch supports VLANs. |
| Broadcast-domain handling | Forwards broadcasts across the connected Layer 2 domain | Forwards broadcasts within each VLAN | Each VLAN is a separate broadcast domain. |
| Spanning-tree capabilities | Depend on the bridge implementation | May support one instance, multiple instances, or per-VLAN variants | Features are platform- and protocol-dependent. |
| Current common usage | Standalone traditional bridges are uncommon | Standard modern LAN access device | Modern switches provide the same core bridge function at greater scale. |
Ports, Hardware, and Performance
Traditional bridges commonly had two ports, or a small number of interfaces, because their purpose was to join a limited number of LAN segments. A switch is designed with many Ethernet ports. This port density means hosts can connect directly to the switch rather than sharing a smaller number of ports through hubs.
Older bridges often made forwarding decisions in software. Modern switches commonly use an ASIC, or Application-Specific Integrated Circuit, to perform high-speed frame lookup and forwarding. Hardware assistance supports higher throughput and lower forwarding latency.
This distinction should not be treated as an absolute definition. A bridge can be built with hardware-assisted forwarding, and a modern switch still uses software for control-plane tasks such as management, topology protocols, and configuration. The core distinction remains functional: a switch is a multiport bridge.
How Layer 2 Forwarding Works
MAC learning
When a bridge or switch receives an Ethernet frame, it reads the frame's source MAC address. It records that address with the port where the frame arrived. This allows the device to learn where hosts are located without requiring a manually entered table.
For example, if a frame from Host A arrives on port 1, the device can record that Host A's MAC address is reachable through port 1. Entries can eventually age out if traffic from a device stops.
Known unicast forwarding
A known unicast is a frame whose destination MAC address appears in the forwarding table. The bridge or switch sends the frame only through the port associated with that destination MAC address.
If the destination is known to be reachable through the same port on which the frame arrived, the device performs filtering and does not send the frame back out that port. This prevents unnecessary forwarding.
Unknown unicast and flooding
An unknown unicast is a frame whose destination MAC address is not currently in the forwarding table. The device normally floods it through all eligible ports in the same VLAN except the incoming port. Broadcast frames are also flooded within that Layer 2 domain. Applicable multicast traffic may be flooded when the device has no more specific forwarding information.
Flooding means sending a frame through all eligible ports except the port on which it was received. Once the destination host sends traffic and its MAC address is learned, later frames can use selective known-unicast forwarding.
| Device | Known unicast behavior | Unknown unicast behavior | Broadcast behavior | Collision-domain effect |
|---|---|---|---|---|
| Hub | Does not inspect MAC addresses; repeats the signal | Repeats the signal to other ports | Repeats the signal to other ports | All attached devices share one collision domain. |
| Bridge | Forwards through the port associated with the destination MAC | Floods across eligible ports on the connected segment | Forwards across the Layer 2 domain | Separates collision domains by bridge port or segment. |
| Layer 2 switch | Forwards only through the destination port | Floods within the applicable VLAN | Floods within the applicable VLAN | Normally provides one collision domain per active switch port. |
Collision Domains
A collision domain is a network segment where Ethernet transmissions can collide when shared half-duplex media is in use. A bridge separates collision domains by port or connected segment. A switch normally gives each connected device its own collision domain because each switch port is a separate forwarding interface.
A hub behaves differently. A hub is a Layer 1 multiport repeater. It sends an incoming signal out its other ports and does not use MAC addresses to filter traffic. Therefore, a hub and every device attached to it share one collision domain, even if the hub uplinks to a bridge or switch.
Modern switched Ethernet normally uses full-duplex links, so collisions generally do not occur on those links. Collision-domain concepts remain important for understanding older Ethernet, hubs, physical topologies, and networking exams.
Broadcast Domains and VLANs
A broadcast domain is the set of devices that receive a Layer 2 broadcast frame. A basic bridge or unmanaged Layer 2 switch forwards broadcasts across all ports in the same Layer 2 segment.
A VLAN, or Virtual LAN, is a logical Layer 2 segmentation mechanism. A managed, VLAN-capable switch can place different ports into different VLANs. Each VLAN forms a separate broadcast domain, even when all the ports belong to one physical switch.
For example, ports for Hosts A and B can be assigned to VLAN 10, while ports for Hosts C and D are assigned to VLAN 20. A broadcast from Host A reaches Host B but not Hosts C and D. Communication between VLAN 10 and VLAN 20 requires inter-VLAN routing, performed by a router or multilayer switch.
Spanning Tree and Layer 2 Loops
Redundant Layer 2 links improve resiliency, but they can create loops. A frame may circulate repeatedly, broadcasts may multiply into a broadcast storm, and switches may learn the same MAC address on different ports. These conditions can cause severe congestion and unstable connectivity.
Spanning Tree Protocol (STP) is a family of Layer 2 loop-prevention protocols. STP calculates a loop-free active topology and places selected redundant paths into a non-forwarding state. If an active path fails, a previously blocked path can become usable according to the protocol and configuration.
A simple bridge or switch may support one spanning-tree instance. More capable switch platforms may support multiple instances or per-VLAN variants, such as a separate spanning-tree topology for individual VLANs. Spanning-tree behavior is not universally fixed for every bridge or switch; it depends on the device's features and protocol implementation.
Four-Host Topology Comparison
Two hubs connected by a two-port bridge
Consider four hosts divided between two hubs:
- Host A and Host B connect to Hub 1.
- Host C and Host D connect to Hub 2.
- Hub 1 connects to one port of a two-port bridge.
- Hub 2 connects to the bridge's other port.
There are two collision domains: the shared Hub 1 segment and the shared Hub 2 segment. Host A and Host B share the first collision domain. Host C and Host D share the second.
When Host A sends a frame to Host C, Hub 1 repeats the signal to its other ports, so Host B receives the transmission on the shared source segment. The bridge examines its forwarding table. If it knows that Host C is on the Hub 2 port, it forwards the frame across the bridge to Hub 2. Hub 2 then repeats the signal to its attached devices, so Host D also receives the signal on that shared segment. If the destination MAC is unknown, the bridge floods the frame to the other eligible segment instead of making a destination-specific decision.
One four-port switch with one host per port
Now replace both hubs and the bridge with a switch:
- Host A connects directly to switch port 1.
- Host B connects directly to switch port 2.
- Host C connects directly to switch port 3.
- Host D connects directly to switch port 4.
This design has four separate switch-port collision domains. With full-duplex links, collisions are normally absent, but each port remains an independent collision-domain boundary for topology analysis.
After MAC learning, the switch knows the port for Host A and the port for Host C. A known unicast frame from Host A to Host C exits only port 3, the port connected to Host C. Hosts B and D do not receive that frame from the switch.
Before Host C's MAC address has been learned, the same destination is an unknown unicast. The switch floods the frame to eligible ports other than the incoming port. When Host C or another device generates return traffic, the switch learns Host C's location, allowing subsequent frames to be forwarded selectively.
| Topology | Physical arrangement | Number of collision domains | What receives a Host A to Host C transmission | Key reason |
|---|---|---|---|---|
| Two hubs plus a two-port bridge | Two shared hub segments joined by a bridge | Two | Hosts on Hub 1 see the source transmission; if the bridge forwards, hosts on Hub 2 also see it. | Hubs repeat signals to shared segments; the bridge separates the segments but does not create one domain per host. |
| One switch with four direct host connections | Each host has its own switch port | Four | After learning, only Host C receives the known unicast from the switch. | The switch selectively forwards based on its MAC address table. |
VLAN Segmentation Example
On a managed switch, assign ports 1 and 2 to VLAN 10 and ports 3 and 4 to VLAN 20. Hosts A and B then share one broadcast domain, while Hosts C and D share another. Broadcasts remain inside their VLAN. A router or multilayer switch is required if hosts in the two VLANs must communicate.
vlan 10
name USERS_A
vlan 20
name USERS_B
interface range gigabitEthernet 0/1 - 2
switchport mode access
switchport access vlan 10
interface range gigabitEthernet 0/3 - 4
switchport mode access
switchport access vlan 20This is an access-port demonstration for a managed switch. It creates separate Layer 2 broadcast domains but does not provide routing between VLANs.
Verifying Switching Features on Cisco IOS
Use these commands to inspect MAC learning, VLAN membership, and spanning-tree operation:
show mac address-table
show mac address-table dynamic
show vlan brief
show interfaces switchport
show spanning-tree
show spanning-tree vlan 10show mac address-tabledisplays learned and static MAC entries.show mac address-table dynamicfocuses on dynamically learned entries.show vlan briefsummarizes VLANs and access-port membership.show interfaces switchportdisplays switchport mode and VLAN details.show spanning-treedisplays spanning-tree state and port roles.show spanning-tree vlan 10examines spanning tree for a specific VLAN.
Troubleshooting Common Symptoms
Unicast traffic is initially sent to several ports
The destination MAC address may not yet be in the MAC address table. The switch treats the frame as unknown unicast and floods it. Inspect the MAC table, generate return traffic from the destination host, and confirm that later frames use only the learned destination port.
Hosts connected to a hub see unexpected traffic
The hub is a shared Layer 1 segment and cannot perform MAC-address filtering. Identify the hub in the physical topology and compare it with direct host-to-switch connections. Devices on the same hub share the segment and its collision domain.
Hosts in different VLANs cannot communicate
Different VLANs are different Layer 2 broadcast domains. Check access-port VLAN assignments, verify that a router interface or multilayer-switch interface exists for each VLAN, and confirm that hosts have suitable default gateways.
Intermittent connectivity and MAC-table movement
Intermittent connectivity, excessive broadcasts, or MAC addresses moving between ports can indicate a Layer 2 loop. Inspect spanning-tree status, check for unintended redundant links, and look for MAC address-table flapping messages or interface counters.
Bridge, Switch, Hub, and Router Roles
A hub operates at Layer 1 and repeats signals. A bridge and a Layer 2 switch operate at Layer 2 and make forwarding decisions using MAC addresses. A router operates at Layer 3 and forwards packets between IP networks or VLANs using network-layer addressing.
A switch is therefore not simply a faster hub. A hub replicates incoming signals to other ports, while a switch learns device locations and selectively forwards frames. A switch is also not automatically a router: Layer 2 switching between ports in the same VLAN does not provide communication between separate IP networks or VLANs.
Summary
- A bridge connects LAN segments and forwards or filters Ethernet frames using MAC addresses.
- An Ethernet switch is a multiport Layer 2 bridge and the normal modern LAN access device.
- Both devices learn source MAC addresses, forward known unicast traffic selectively, filter unnecessary traffic, and flood unknown unicast and broadcast traffic within the applicable Layer 2 domain.
- Bridges and switches separate collision domains, while a hub and its attached devices share one collision domain.
- A basic bridge or unmanaged switch normally forwards broadcasts across its Layer 2 domain.
- A VLAN-capable switch can create multiple broadcast domains, but communication between VLANs requires Layer 3 routing.
- STP prevents redundant Layer 2 paths from forming forwarding loops, with capabilities varying by platform and implementation.
For a related review of the same core comparison, see switch and bridge differences.