What Is a Network Bridge?

Learn what a network bridge is, how it forwards Ethernet frames at OSI Layer 2, how MAC learning works, and how bridges differ from hubs and switches.

A network bridge is a Layer 2 networking device that connects two or more LAN segments and selectively forwards Ethernet frames between them. It examines MAC addresses to decide whether traffic should remain on its incoming segment or cross to another segment.

Bridges were especially useful on older shared Ethernet networks. By dividing a busy LAN into smaller segments, a bridge reduced unnecessary traffic and separated collision domains. Dedicated bridge hardware is less common today, but the same principles are fundamental to Ethernet switches, wireless access points, and software-defined networks.

What Is the Purpose of a Network Bridge?

A bridge connects LAN segments while controlling which Ethernet frames pass between them. A LAN segment is a portion of a local network that shares a physical transmission path or connects to one bridge port.

The bridge has two closely related purposes:

  • Connect segments: Devices on different segments can communicate at Layer 2.
  • Reduce unnecessary traffic: Frames intended for devices on one segment do not need to be transmitted onto every other segment.

On legacy shared Ethernet, several devices competed for the same medium. Simultaneous transmissions could interfere with one another. A bridge reduced the number of devices competing on each segment, improving effective bandwidth and reducing collisions.

Where Does a Bridge Operate in the OSI Model?

A bridge operates at Layer 2, the Data Link layer, of the OSI model. The Data Link layer handles Ethernet frames and local hardware-oriented addresses called MAC addresses.

An Ethernet frame is the Layer 2 unit of data. Among other fields, it contains a source MAC address and a destination MAC address. A MAC address identifies a network interface for local Ethernet communication.

A bridge makes forwarding decisions using destination MAC addresses, not destination IP addresses. This distinguishes bridging from routing:

  • Layer 2 bridging: Examines Ethernet frames and MAC addresses within a broadcast domain.
  • Layer 3 routing: Examines IP packets and IP addresses and can move traffic between different IP networks.

A bridge normally does not create a new IP network. It extends or divides the physical portions of the same Layer 2 network.

Collision Domains and Bandwidth

A collision domain is a shared network area in which simultaneous Ethernet transmissions can collide when the links operate in half-duplex mode. Older Ethernet networks commonly used hubs and shared cabling, so all connected devices competed for the same medium.

A bridge separates its connected segments into distinct collision domains. For example, if a bridge joins Segment 1 and Segment 2, devices on Segment 1 compete with one another, but their transmissions do not directly contend with devices on Segment 2.

This can improve network performance because:

  • Fewer devices compete on each shared segment.
  • Traffic that belongs on one segment can be kept there.
  • Each segment has more of its shared bandwidth available to local devices.
  • Collisions are reduced on legacy half-duplex Ethernet.

Collision behavior is mainly a historical concern for shared, half-duplex Ethernet. Modern switched Ethernet links normally operate full-duplex, with a separate point-to-point link per switch port. Normal Ethernet collisions do not occur on those links.

How a Bridge Processes an Ethernet Frame

When a frame arrives, a transparent bridge performs a sequence of basic operations:

  1. Receive: The bridge receives the frame on one port or connected segment.
  2. Learn: It records the source MAC address and associates it with the incoming port or segment.
  3. Inspect: It checks the destination MAC address.
  4. Look up: It searches its forwarding table for the destination address.
  5. Decide: It filters, forwards, or floods the frame according to the table and the destination type.

Filtering means not forwarding a frame when the destination is reachable on the same segment where the frame arrived. The frame can be delivered locally without using the other bridge ports.

Forwarding means sending the frame through the port or segment where the destination is known to exist.

Flooding means sending a frame out all relevant bridge ports except the port on which it arrived. Bridges flood unknown unicast frames because they do not yet know where the destination is. They also forward broadcast frames to other ports within the same Layer 2 broadcast domain.

A broadcast domain is the set of devices that receive a Layer 2 broadcast frame. A basic bridge does not inherently divide this domain. Broadcasts can therefore cross a bridge, even though ordinary known unicast traffic can be selectively filtered.

Bridge Frame-Handling Decisions

Destination MAC status | Destination location | Bridge action | Result

Known MAC | Incoming segment | Filter | The frame stays on the incoming segment.

Known MAC | Different segment | Forward | The frame is sent only toward the destination segment.

Unknown unicast MAC | Unknown | Flood | The frame is sent to other relevant ports in the same Layer 2 domain.

Broadcast MAC address | All segments in the same domain | Forward or flood | The frame is sent to other bridge ports in that broadcast domain.

Multicast handling can be treated similarly at a basic level: a bridge may send multicast traffic to multiple ports. More advanced switches can use multicast-aware mechanisms to limit which ports receive particular multicast streams.

MAC Address Learning and the Forwarding Table

MAC learning is the process of learning a source MAC address from the port where a frame arrives. A transparent bridge does not need every host to be manually configured. It builds its knowledge by observing normal traffic.

The bridge stores this information in a MAC address table, also called a forwarding table. The table maps a learned MAC address to a bridge port or network segment.

Example MAC Address Table

MAC address | Learned port or segment | How it was learned | Entry status

Host A MAC address | Segment 1 | Observed as the source of a received frame | Dynamically learned

Host C MAC address | Segment 2 | Observed as the source of a received frame | Dynamically learned

Suppose a frame arrives from Segment 1 with Host A's MAC address as its source. The bridge records that Host A is reachable through Segment 1. If a later frame is addressed to Host A and arrives from Segment 2, the bridge can forward it only to Segment 1.

Dynamically learned entries are not permanent. They age out when they are not refreshed for a period of time. This allows the table to adapt when a device moves, disconnects, or changes its connection.

Worked Topology: Four Hosts and Two Segments

Consider a bridge joining two Ethernet segments:

  • Segment 1: Host A and Host B
  • Segment 2: Host C and Host D
  • Bridge: Connects Segment 1 to Segment 2

Each segment is a separate collision domain in the traditional shared-Ethernet sense. The two segments remain part of the same Layer 2 broadcast domain unless another feature, such as VLAN separation or routing, divides them.

Host A Sends to Host C

  1. Host A creates an Ethernet frame with Host A's MAC address as the source and Host C's MAC address as the destination.
  2. The bridge receives the frame from Segment 1.
  3. The bridge learns or refreshes Host A's MAC address as reachable through Segment 1.
  4. The bridge checks its MAC address table for Host C.
  5. If the table shows Host C on Segment 2, the bridge forwards the frame to Segment 2.
  6. Host C receives the frame. The bridge does not send the known unicast frame back onto Segment 1.

This is the main benefit of bridging: the bridge allows communication between segments while avoiding transmission to an irrelevant segment.

Host A Sends to Host B

  1. The bridge receives a frame from Segment 1 addressed to Host B.
  2. The bridge looks up Host B's MAC address.
  3. If the table shows Host B on Segment 1, the bridge filters the frame.
  4. The frame is not transmitted onto Segment 2, where Hosts C and D are connected.

Host A and Host B can communicate locally without making the other segment carry their traffic.

Host A Sends to an Unknown Destination

  1. The bridge learns Host A's source MAC address on Segment 1.
  2. The destination MAC address is not present in the table.
  3. The bridge floods the frame to other connected segments, excluding the incoming segment.
  4. If the destination replies from Segment 2, the bridge learns the destination's location.
  5. Future frames can then be forwarded selectively instead of flooded.

Bridge Frame-Forwarding Flow

The forwarding logic can be summarized as:

Receive Ethernet frame on incoming segment
    Learn or refresh the source MAC on that segment
    Read the destination MAC
    If destination is known on the incoming segment:
        Filter the frame
    Else if destination is known on another segment:
        Forward the frame to that segment
    Else if destination is unknown unicast:
        Flood to other relevant segments
    Else if destination is broadcast:
        Forward to other ports in the same broadcast domain

Bridge Versus Hub

A network hub is a Layer 1 device. It repeats incoming electrical or optical signals out of its other ports. A hub does not inspect Ethernet MAC addresses and does not make selective forwarding decisions.

A hub creates one shared collision domain. If four hosts connect through a hub, all four share the same transmission medium. A frame or signal is repeated toward every other port, whether or not the receiving device is the intended destination.

A bridge improves on this behavior by examining frames and separating collision domains:

  • A hub repeats signals broadly; a bridge makes MAC-aware decisions.
  • A hub retains one shared collision domain; a bridge creates separate collision domains for its connected segments.
  • A hub sends traffic to all other ports; a bridge can filter local traffic or forward only toward a known destination segment.

Bridge Versus Switch

An Ethernet switch performs the same broad Layer 2 functions as a bridge: it learns source MAC addresses, stores them in a MAC address table, and forwards or filters frames based on destination MAC addresses.

In practical terms, a switch is a multiport bridge. Standalone bridges generally had a small number of ports, while switches provide many ports and are designed for modern LAN performance. Switches largely replaced dedicated bridge appliances because they offer more ports, higher aggregate throughput, full-duplex operation, VLAN support, management features, and other capabilities.

Each switch port is normally its own collision domain. A switch still commonly represents one broadcast domain when all ports belong to the same VLAN. VLANs can create multiple Layer 2 broadcast domains within one physical switch.

Bridge vs. Hub vs. Switch

Characteristic | Bridge | Hub | Switch

Primary OSI layer | Layer 2 | Layer 1 | Layer 2

Forwarding basis | Destination MAC address | Repeated signal; no MAC decision | Destination MAC address

Collision-domain behavior | Separates connected segments | One shared collision domain | Normally one collision domain per port

Traffic sent to all ports or selectively forwarded | Selectively forwarded, with flooding when needed | Sent to all other ports | Selectively forwarded, with flooding when needed

Typical modern use | Concepts, limited special-purpose or software use | Rare in modern LANs | Standard wired LAN device

What a Bridge Does Not Do

A bridge does not inherently divide a Layer 2 broadcast domain. Broadcast frames, such as an Ethernet frame addressed to the broadcast MAC address, can still travel across the bridge to other segments in the same VLAN or broadcast domain.

To separate IP broadcast domains, a network normally needs a router or another Layer 3 boundary. VLANs can also define separate Layer 2 broadcast domains, but communication between those VLANs requires Layer 3 forwarding.

Bridges and switches also introduce a loop risk. If redundant Layer 2 paths exist between segments, frames can circulate indefinitely. This can produce duplicate frames, unstable MAC-table entries, and broadcast storms. Spanning Tree Protocol, or STP, prevents loops by logically blocking selected redundant paths while keeping them available for failover.

Modern Relevance of Bridging

Dedicated bridge devices are uncommon in typical modern wired LANs, but bridging is not an obsolete idea. Switches use bridge learning and forwarding behavior on a much larger scale. Wireless access points bridge wireless clients to a wired LAN. Operating systems and hypervisors use software bridges to connect virtual machines, containers, and physical interfaces.

Understanding bridges makes it easier to understand switching, VLANs, wireless bridging, virtual networking, MAC address tables, and Spanning Tree Protocol. The device may change, but the fundamental question remains the same: where should this Layer 2 frame go?

Optional Verification Examples

No vendor-specific configuration is required to understand the core concepts. If you use a managed switch as a modern bridge demonstration, a Cisco IOS device commonly displays learned MAC addresses with:

show mac address-table

The output maps learned MAC addresses to switch interfaces. The exact command and output format depend on the vendor and operating system.

For advanced Linux software-bridge inspection, these commands display bridge and forwarding-database information:

bridge link
bridge fdb show

Use these commands only as supplementary examples. The essential lesson is the relationship between a learned MAC address and the port or segment through which that address is reachable.

Troubleshooting Bridge Behavior

A Host Cannot Reach a Device on Another Segment

Check the physical connection between the bridge and both segments. Verify link status on both bridge connections, confirm that the destination MAC address is learned on the expected port or segment, and check whether frames are being forwarded toward the correct segment. In a modern switch, also verify the VLAN assignment. The destination host itself may also be disconnected or misconfigured.

Traffic Appears on Every Segment

Inspect the MAC address table for expected learned entries. Many unknown unicast frames may indicate missing or unstable MAC learning. High broadcast traffic can also appear on every segment in the same broadcast domain. Finally, confirm that the network uses a bridge or switch rather than a hub and that endpoints are connected to the intended segments.

Performance Degrades and Duplicate Frames Appear

Look for redundant Layer 2 paths between the same segments. Verify that Spanning Tree Protocol is enabled and operating correctly. Remove unintended redundant links or configure STP appropriately. A Layer 2 loop can cause circulating frames, duplicate traffic, broadcast storms, and rapidly changing MAC-table entries.

Exam-Relevant Summary

  • A bridge is a Layer 2 device that selectively forwards Ethernet frames between LAN segments.
  • Bridges use MAC addresses, not IP addresses, for their forwarding decisions.
  • A bridge separates collision domains but does not inherently separate broadcast domains.
  • Known unicast traffic is forwarded to the destination segment or filtered when the destination is on the incoming segment.
  • Unknown unicast and broadcast traffic are flooded or forwarded to relevant ports within the same Layer 2 domain.
  • MAC learning records a source MAC address against the incoming port or segment.
  • Dynamically learned MAC entries age out when they are not refreshed.
  • A hub is a Layer 1 repeater; a switch is effectively a multiport bridge.
  • Routers or Layer 3 boundaries separate IP broadcast domains.
  • Spanning Tree Protocol prevents loops caused by redundant Layer 2 paths.

For a concise definition, see What Is a Network Bridge?.