Network Bridges: Definition, Operation, and Role

1. What Is a Network Bridge?

A network bridge is a Layer 2 (Data Link layer) device that connects two or more network segments within a LAN, enabling devices on separate segments to communicate as though they are on the same network. Unlike a hub (which blindly repeats signals to all ports), a bridge is intelligent — it inspects the MAC address of each incoming frame and makes a deliberate forwarding or filtering decision based on a learned MAC address table.

The bridge's primary architectural contribution was dividing a single large collision domain into multiple smaller, isolated ones — dramatically reducing collisions and improving network efficiency in the era before switches became ubiquitous.

Classic scenario: A company has two departments — Accounts (Segment A) and HR (Segment B) — each with its own group of computers connected by a shared coaxial Ethernet. A bridge connects both segments. When an Accounts PC sends a file to another Accounts PC, the bridge sees the destination MAC is on Segment A and filters (does not forward) the frame — HR's traffic is unaffected. When an Accounts PC sends to HR, the bridge forwards the frame across.

Related pages: Network Switches | Network Hubs | Network Routers | OSI Model | MAC Addresses | CAM / MAC Address Table | Frame Forwarding | STP Overview | PVST & Spanning Tree | STP Port Roles | Root Bridge Election

2. How a Bridge Works — MAC Learning and Frame Decisions

A bridge maintains a MAC address table (also called a forwarding table or bridge table) that maps MAC addresses to the port on which each device was last seen. This table is built dynamically through a process called MAC learning and drives all forwarding decisions.

Step-by-Step: The Four Bridge Behaviours

  1. Learning: When a frame arrives on a port, the bridge records the source MAC address and associates it with the port the frame arrived on. This populates the MAC table over time.
  2. Filtering: If the destination MAC is in the table and mapped to the same port the frame arrived on, the bridge drops the frame — both source and destination are on the same segment, so forwarding is unnecessary.
  3. Forwarding: If the destination MAC is in the table and mapped to a different port, the bridge forwards the frame only out of that specific port — not all ports.
  4. Flooding: If the destination MAC is not in the table (unknown destination) or the frame is a broadcast/multicast, the bridge floods the frame out of all ports except the one it arrived on.

MAC Learning and Forwarding — Step-by-Step Diagram

  Bridge with 2 ports: Port 1 (Segment A) and Port 2 (Segment B)
  MAC table starts empty.

  ── Event 1: PC-A (MAC: AA) sends a frame to PC-C (MAC: CC) ──
  Frame arrives on Port 1
  Bridge learns: AA → Port 1  (source learning)
  Bridge checks table for CC → Not found
  Bridge FLOODS out Port 2 (unknown destination)

  MAC Table:
  ┌──────────┬──────┐
  │ MAC      │ Port │
  ├──────────┼──────┤
  │ AA       │  1   │
  └──────────┴──────┘

  ── Event 2: PC-C (MAC: CC) replies to PC-A (MAC: AA) ──
  Frame arrives on Port 2
  Bridge learns: CC → Port 2  (source learning)
  Bridge checks table for AA → Found on Port 1
  Bridge FORWARDS only out Port 1 (targeted delivery)

  MAC Table:
  ┌──────────┬──────┐
  │ MAC      │ Port │
  ├──────────┼──────┤
  │ AA       │  1   │
  │ CC       │  2   │
  └──────────┴──────┘

  ── Event 3: PC-A (MAC: AA) sends to PC-B (MAC: BB) ──
  Both are on Segment A (Port 1)
  Bridge checks table for BB → Found on Port 1 (same as source)
  Bridge FILTERS (drops) the frame — local traffic stays local
Exam tip: Bridges only make one decision per frame — forward, filter, or flood. They never modify the frame contents. The destination MAC in the frame always remains unchanged as it passes through the bridge.

3. Collision Domains vs. Broadcast Domains

Understanding what bridges divide (and what they don't) is a fundamental CCNA concept.

Domain Type Definition Bridge Effect Who Stops It
Collision Domain A network segment where two devices transmitting simultaneously cause a collision (applies to half-duplex shared media) ✅ Each bridge port is a separate collision domain — collisions are contained within each segment Bridges and switches
Broadcast Domain The group of devices that receive a broadcast frame (Destination MAC: FF:FF:FF:FF:FF:FF) ❌ Bridges forward broadcasts to all ports — they do NOT segment broadcast domains Routers (Layer 3) only

Collision Domain Diagram

  Without a Bridge (shared Ethernet hub):
  ┌─────────────────────────────────────────────┐
  │  PC-A  PC-B  PC-C  PC-D  PC-E  PC-F        │
  │           ONE collision domain              │
  │  All devices compete for the same medium    │
  └─────────────────────────────────────────────┘

  With a Bridge:
  ┌───────────────────┐     ┌───────────────────┐
  │  PC-A  PC-B  PC-C │     │  PC-D  PC-E  PC-F │
  │  Collision        │     │  Collision        │
  │  Domain 1         │◀───▶│  Domain 2         │
  │                   │Bridge│                  │
  └───────────────────┘     └───────────────────┘
  2 separate collision domains — collisions in Domain 1
  do NOT affect Domain 2, and vice versa.

  But still ONE broadcast domain — a broadcast from PC-A
  reaches PC-D, PC-E, and PC-F through the bridge.
Memory rule: Bridges separate collision domains but NOT broadcast domains. Only a router separates broadcast domains. A switch is a multiport bridge — same rules apply.

4. Types of Bridges

Bridge Type Description How It Works Typical Use Case
Transparent Bridge Most common type — operates completely invisibly to end devices. Devices on either segment have no knowledge the bridge exists. Builds MAC table by source learning; makes forward/filter/flood decisions. Fully compliant with IEEE 802.1D. Standard Ethernet LAN segmentation; the predecessor to modern switches
Source Routing Bridge Used in IBM Token Ring networks. The end device (source) is responsible for determining the path through the network — it embeds routing information in the frame header. Bridge reads path information already embedded in the frame by the sender and forwards accordingly — no MAC learning needed. Legacy IBM Token Ring networks (obsolete)
Translational Bridge Connects two fundamentally different network types — it must convert not just forward, translating frame formats between the two media. Receives a frame in one format (e.g., Ethernet) and rebuilds it in the other format (e.g., Token Ring or Wi-Fi), handling differences in frame size, addressing, and field structure. Legacy Ethernet-to-Token Ring integration; modern wireless APs acting as 802.11-to-Ethernet bridges
Wireless Bridge A special modern application of bridging — connects two separate wired LAN segments using a wireless (802.11) link as the transport between them. Two wireless bridge devices form a point-to-point or point-to-multipoint wireless link; each bridge converts between wired Ethernet and wireless 802.11 frames. Building-to-building connectivity; extending a LAN across a campus without laying cable; AP bridge mode
Remote Bridge Connects LAN segments across a WAN link (serial, frame relay, DSL). Encapsulates Ethernet frames for transport across the WAN link; the remote bridge decapsulates and forwards to the destination segment. Legacy wide-area LAN extension before modern MPLS/VPN solutions

5. Spanning Tree Protocol (STP) and Bridges

When a network has redundant bridge/switch paths for reliability, those paths create Layer 2 loops. Unlike IP packets (which have a TTL field that expires), Ethernet frames have no loop-prevention mechanism — a looping broadcast frame circulates forever, consuming all available bandwidth in a broadcast storm.

The Broadcast Storm Problem

  Bridge A ─────── Bridge B
      │                 │
      └──── Bridge C ───┘

  Without STP: A broadcast frame from PC-X is forwarded by all
  three bridges endlessly — each bridge receives copies from two
  directions and forwards both, doubling traffic every loop.
  → Network saturated within seconds. All hosts unreachable.

How STP Solves It (IEEE 802.1D)

STP enables bridges to automatically negotiate a loop-free topology by logically blocking one or more redundant paths while keeping them ready for failover.

  1. Root Bridge election: All bridges exchange BPDUs (Bridge Protocol Data Units) to elect one bridge as the root — the bridge with the lowest Bridge ID (priority + MAC address) wins.
  2. Root Port selection: Each non-root bridge selects the port with the lowest-cost path to the root bridge as its Root Port.
  3. Designated Port selection: On each network segment, the bridge with the best path to the root is the Designated Bridge — its port on that segment is the Designated Port (forwarding).
  4. Blocking: All remaining ports that would create a loop are placed in Blocking state — they receive BPDUs but do not forward user traffic.

STP Port States

State Sends/Receives BPDUs Learns MACs Forwards Frames Duration
Blocking Receives only No No Up to 20 sec (Max Age)
Listening Yes No No 15 sec (Forward Delay)
Learning Yes Yes No 15 sec (Forward Delay)
Forwarding Yes Yes Yes Normal operation
Disabled No No No Administratively shut down
STP convergence time: Traditional 802.1D STP takes 30–50 seconds to converge after a topology change (Blocking → Listening → Learning → Forwarding). Rapid STP (RSTP / IEEE 802.1w) reduces this to under 1 second using handshake mechanisms.

See: STP Overview | PVST & Spanning Tree | STP Port Roles | Root Bridge Election | PortFast & BPDU Guard

6. Bridges vs. Switches — A Critical Comparison

A switch is essentially a multiport bridge — it performs identical Layer 2 MAC learning and forwarding functions, but with hardware acceleration and many more ports. Understanding the distinction between the two is a recurring CCNA exam topic.

Aspect Bridge Switch
Number of ports Typically 2–4 ports 8 to 48+ ports (enterprise: 96+)
Frame processing Software-based — CPU processes each frame Hardware ASIC-based — wire-speed forwarding
Throughput Low — limited by software processing speed Very high — hardware forwarding at line rate
Scalability Very limited — not practical beyond small networks High — stackable, chassis-based for thousands of ports
Collision domains One per port (same as switch) One per port
Broadcast domains One for the entire bridge (same as switch) One per VLAN (with VLANs configured)
VLAN support None (traditional bridges) Full 802.1Q VLAN support — multiple broadcast domains
Spanning Tree IEEE 802.1D (classic STP) IEEE 802.1D / 802.1w (RSTP) / 802.1s (MSTP) / PVST+
Advanced features None Port security, QoS, DHCP Snooping, DAI, trunk ports, etc.
Modern usage Rare — largely legacy Universal — the standard LAN access/distribution device
Conceptual key: A switch is a bridge with many ports and hardware acceleration. The forwarding logic is identical — MAC learning, filtering, forwarding, flooding. The difference is implementation scale and speed. When Cisco documentation says "switch" for CCNA purposes, it means a multiport hardware bridge running STP.

See: Network Switches — Full Guide | CAM / MAC Address Table | show mac address-table

7. Bridging Domains, VLANs, and Broadcast Traffic

A critical limitation of traditional bridges is that they forward broadcasts to all ports — a bridge does not segment broadcast domains. Every device connected to a bridge (regardless of which port) receives every broadcast frame.

  • ARP Requests, DHCP Discovers, and other broadcasts traverse the bridge and reach all segments.
  • As the network grows, excessive broadcasts consume bandwidth and degrade performance — this is the fundamental problem that motivated VLAN segmentation.
  • Traditional bridges do not support VLANs natively — they have no concept of tagging or separating broadcast domains per VLAN.
  • Modern switches address this by using 802.1Q VLANs to create separate broadcast domains — broadcasts in VLAN 10 are never forwarded to VLAN 20 ports.
Broadcast domain separation: Only a router (Layer 3) natively separates broadcast domains. A switch with VLANs effectively uses the VLAN boundary as a broadcast domain separator, but inter-VLAN traffic still requires routing (a router or Layer 3 switch).

8. Wireless Bridges — Modern Application

While traditional wired bridges are largely obsolete, wireless bridging remains an active, relevant technology. A wireless bridge connects two physically separate wired LAN segments using an 802.11 (Wi-Fi) wireless link as the transport between them. 

  Building A                              Building B
  ┌──────────────┐   Wireless link   ┌──────────────┐
  │ Wired LAN    │  ←────────────→   │ Wired LAN    │
  │ (switch)     │  802.11 bridge    │ (switch)     │
  │      │       │                   │       │      │
  │  [Bridge A]  │                   │  [Bridge B]  │
  │  (AP mode:   │                   │  (AP mode:   │
  │   bridge)    │                   │   bridge)    │
  └──────────────┘                   └──────────────┘

  Result: Both wired LANs act as one Layer 2 segment.
  No cable between buildings required.

Common wireless bridge deployment modes:

  • Point-to-Point (PtP): Two wireless bridge devices connect two buildings — one acts as root, the other as non-root.
  • Point-to-Multipoint (PtMP): One central wireless bridge connects multiple remote segments — like a hub-and-spoke model over wireless.
  • Workgroup Bridge (WGB): A wireless client that connects a group of wired devices to a wireless network — bridges wired clients onto Wi-Fi.
  • AP Bridge Mode: Cisco lightweight APs can be placed in bridge/mesh mode via the WLC — used in outdoor deployments and campus mesh networks.

See: Access Points & WLC

9. Bridge Configuration — Legacy Cisco IOS and Linux

While dedicated hardware bridges are rare today, bridging is still configured in Cisco IOS for specific features (Integrated Routing and Bridging — IRB) and is widely used in Linux environments for virtualisation.

Cisco IOS — Integrated Routing and Bridging (IRB)

! Create a bridge group
Router(config)# bridge 1 protocol ieee

! Assign interfaces to bridge group 1
Router(config)# interface FastEthernet0/0
Router(config-if)# bridge-group 1

Router(config)# interface FastEthernet0/1
Router(config-if)# bridge-group 1

! Verify bridge table
Router# show bridge
Bridge Group 1: Spanning tree IEEE 802.1D
  Ports: Fa0/0 (Forwarding), Fa0/1 (Forwarding)
  Port  MAC-Addr   Age  Interface
  1     0050.56aa.bb01   3   Fa0/0
  2     0013.ceff.1234   1   Fa0/1

Linux — Software Bridge (used in KVM/Docker virtualisation)

# Create a bridge interface
ip link add name br0 type bridge

# Add physical interfaces to the bridge
ip link set eth0 master br0
ip link set eth1 master br0

# Bring bridge up
ip link set br0 up
ip addr add 192.168.1.1/24 dev br0

# Show bridge forwarding table (MAC table)
bridge fdb show br br0

# Show bridge details
bridge link show
Linux bridges in modern infrastructure: Linux software bridges are the backbone of virtual machine networking (KVM/QEMU), container networking (Docker bridge networks), and cloud hypervisors. The same MAC learning and forwarding concepts apply — just implemented in software rather than dedicated hardware.

10. Advantages and Limitations of Bridges

Advantages Limitations
  • Reduces collision domains — each port is a separate collision domain
  • Extends LAN reach without requiring routing or IP configuration
  • Transparent operation — end devices are unaware of the bridge's presence
  • Self-configuring — builds MAC table automatically through source learning
  • Can connect different physical media types (translational bridging)
  • Wireless bridging enables building-to-building connectivity without cable
  • Software-based processing — significantly slower than hardware switches
  • Limited port count — not scalable beyond a few segments
  • Forwards broadcasts — does not reduce broadcast domain size
  • No VLAN support in traditional implementations
  • No advanced security features (port security, DAI, DHCP Snooping)
  • Redundant paths require STP — adds complexity and convergence delay
  • Largely replaced by switches in all modern network designs

11. Use Cases for Bridges Today

  • Legacy network integration: Connecting older 10BASE-T or coaxial Ethernet segments to modern Gigabit infrastructure during phased upgrades — a bridge spans the technology gap without replacing all hardware at once.
  • Wireless LAN bridging: APs in bridge mode connecting buildings, outdoor areas, or remote wired equipment to the main LAN wirelessly — still actively used in enterprise and industrial networks.
  • Virtual machine networking: Linux and hypervisor bridges connect VMs to physical network segments — a core component of modern cloud and data-centre infrastructure.
  • Embedded/IoT environments: Low-power embedded systems sometimes use software bridges to connect different network interfaces (e.g., Wi-Fi + Ethernet) on edge devices.
  • CCNA exam context: Bridge concepts — MAC learning, forwarding/filtering/flooding, collision vs broadcast domains, and STP — form the foundational theory behind all modern switching. Understanding bridges is essential for understanding switches.

12. Common Misconceptions About Bridges

  • "A bridge divides both collision domains and broadcast domains."
    Bridges divide collision domains only. Broadcast frames (FF:FF:FF:FF:FF:FF) are forwarded out all bridge ports — the entire bridged network remains one broadcast domain. Only a router separates broadcast domains.
  • "A bridge is the same as a hub."
    A hub is a Layer 1 device that blindly repeats all signals to every port — it has no intelligence, creates one large collision domain, and cannot filter traffic. A bridge is Layer 2, makes intelligent forwarding decisions based on MAC addresses, and creates separate collision domains per port.
  • "A switch and a bridge are completely different devices."
    A switch is conceptually a multiport, hardware-accelerated bridge. Both operate at Layer 2, both use MAC learning, both forward/filter/flood based on the MAC table. The difference is implementation — more ports, hardware ASICs, and advanced features in a switch.
  • "Bridges are completely obsolete and irrelevant to modern networking."
    While hardware bridges are legacy, bridging as a concept is very much alive: wireless bridges connect buildings, Linux bridges underpin virtualisation, and all switching theory is rooted in bridge operation. The CCNA exam directly tests bridge concepts including STP, MAC learning, and collision vs broadcast domain distinctions.
  • "STP is only relevant to bridges, not switches."
    STP (and its evolutions RSTP, MSTP, PVST+) are just as relevant to switches as to bridges — they solve the same loop-prevention problem. Every enterprise switch runs a form of STP.

13. Key Points & Exam Tips

  • Bridges operate at OSI Layer 2 — they use MAC addresses, not IP addresses.
  • Four bridge behaviours: Learn (source MAC), Filter (same segment), Forward (different segment), Flood (unknown/broadcast).
  • Each bridge port is a separate collision domain — but bridges do NOT divide broadcast domains.
  • Only a router separates broadcast domains. Switches use VLANs to create multiple broadcast domains.
  • A switch is a multiport bridge with hardware ASICs — identical forwarding logic, far more ports and speed.
  • Transparent bridge — most common; invisible to devices; builds MAC table dynamically.
  • Translational bridge — connects different media types (e.g., Ethernet to Token Ring); modern wireless APs are a form of translational bridge.
  • STP (IEEE 802.1D) prevents Layer 2 loops by blocking redundant paths using BPDUs, root bridge election, and port state machine.
  • STP port states in order: Blocking → Listening → Learning → Forwarding.
  • Classic STP convergence: ~30–50 seconds. RSTP (802.1w): <1 second.

Related pages: Network Switches | Network Hubs | Network Routers | OSI Model | VLANs | MAC Addresses | CAM / MAC Address Table | Frame Forwarding | STP Overview | PVST & Spanning Tree | STP Port Roles | Root Bridge Election | PortFast & BPDU Guard | Access Points & WLC | Spanning Tree Root Bridge Config | RSTP Configuration

14. Network Bridge Quiz

1. A bridge receives a frame on Port 1. The source MAC is AA and the destination MAC is BB. The bridge's MAC table shows BB is also mapped to Port 1. What does the bridge do with this frame?

Correct answer is B. When a bridge checks its MAC table and finds the destination MAC on the same port the frame arrived on, it filters (drops) the frame. Both the source and destination are on the same network segment — forwarding the frame would just send it back where it came from. This filtering behaviour is what reduces unnecessary inter-segment traffic and is a core function of bridges.

2. A network administrator adds a bridge between two Ethernet segments. A host on Segment A sends a broadcast frame. What happens?

Correct answer is D. Bridges forward broadcast frames (destination MAC FF:FF:FF:FF:FF:FF) out all ports except the one they arrived on. Bridges do not segment broadcast domains — all devices connected to the bridge, regardless of which port, receive every broadcast. Only a router (Layer 3 device) stops broadcasts at a subnet boundary. This is a critical distinction on the CCNA exam.

3. A bridge's MAC table is empty. PC-A (MAC: AA) sends a frame to PC-C (MAC: CC). What does the bridge do and why?

Correct answer is C. When a bridge receives a frame with a destination MAC address not in its table (unknown unicast), it floods the frame out all ports except the one it arrived on — this ensures delivery regardless of where the destination is located. Simultaneously, the bridge learns the source MAC (AA) and records it against the arrival port. Over time, as devices respond, the MAC table fills in and flooding gives way to targeted forwarding.

4. Which statement correctly describes the relationship between a bridge and a switch?

Correct answer is A. A switch is fundamentally a multiport bridge with hardware ASIC acceleration. Both devices operate at Layer 2, both build MAC tables through source learning, and both make the same four decisions: filter, forward, flood, or learn. The practical differences are that switches have many more ports, use hardware for wire-speed forwarding, and add advanced features like VLANs — but the core bridging logic is identical.

5. A network has three bridges connected in a triangle topology to provide redundancy. Without STP, what happens when a broadcast frame is introduced?

Correct answer is C. Without STP, redundant bridge paths create Layer 2 loops. A broadcast frame has no TTL equivalent — it is forwarded by every bridge out all ports except where it arrived. In a triangle topology, the frame is forwarded in both directions simultaneously, each copy arriving at the next bridge and being forwarded again. Within seconds, thousands of copies circulate simultaneously — a broadcast storm that saturates all links and makes the network unusable.

6. In STP, which bridge becomes the root bridge?

Correct answer is D. STP elects the root bridge based on the Bridge ID — a combination of a configurable priority value (default 32768) and the bridge's MAC address. The bridge with the numerically lowest Bridge ID wins the election. Priority is compared first; if equal, the lowest MAC address is the tiebreaker. To control which bridge becomes root, administrators lower the priority on the desired root bridge (e.g., spanning-tree vlan 1 priority 4096).

7. What is the correct sequence of STP port states when a port transitions from blocked to active forwarding?

Correct answer is B. The STP port state sequence is: Blocking (receives BPDUs, no forwarding, no learning) → Listening (sends/receives BPDUs, participates in election, still no forwarding or learning, 15 sec) → Learning (builds MAC table, still no forwarding, 15 sec) → Forwarding (normal operation). Total classic STP convergence: up to 50 seconds. RSTP (802.1w) can achieve convergence in under 1 second.

8. A company installs a transparent bridge between two office Ethernet segments. Six months later, one segment grows to 120 devices. What is the most likely performance issue caused by the bridge?

Correct answer is A. A bridge does not segment broadcast domains. With 120 devices in one segment plus the other segment's devices all sharing one broadcast domain, every ARP request, DHCP Discover, and other broadcast reaches every device. As device count grows, broadcast traffic grows proportionally, consuming bandwidth and CPU cycles on all hosts. The solution is VLANs on a switch — which creates separate broadcast domains — or a router to segment subnets.

9. Which scenario represents a valid modern use of bridging technology?

Correct answer is C. Wireless bridging is an active, modern use of bridge technology. Two APs in bridge mode create a point-to-point wireless link, connecting two wired LANs across a building or campus without needing physical cabling between them. This is used extensively in enterprise, industrial, and outdoor networking. Options A and D require Layer 3 routing and VLAN-capable switches respectively — traditional bridges cannot do either.

10. A bridge port has been in the Listening state for 15 seconds. According to classic 802.1D STP, what does the port do next, and what does it still NOT do at that point?

Correct answer is B. After 15 seconds in the Listening state (Forward Delay timer), the port transitions to the Learning state. In Learning, the bridge begins populating its MAC address table from incoming frames — this pre-populates the table to reduce flooding when the port eventually forwards. However, the port still does NOT forward user traffic in Learning state. After another 15 seconds of Learning, the port finally transitions to Forwarding. Total transition time from Blocking to Forwarding: up to 50 seconds.

← Back to Home