I have a question about the bridge vs router packet filtering using firewalls. I know the basics of the router and bridge and on which layers they work. I just wanna know that on bridge how does packet filtering works, I mean on the basis of mac addresses or bridge interfaces, etc. What things are used in the bridge for packet filtering.

  • Packets are layer-3 datagrams, so a layer-2 bridge doesn't know or care about packets. That allows any layer-3 protocol (IPv4, IPX, IPv6, AppleTalk, etc.) to work on ethernet. Also, the layer-3 protocol doesn't know or care which layer-2 protocol carries it (ethernet, PPP, token ring, frame relay, ATM, Wi-Fi, HDLC, etc.). – Ron Maupin Oct 30 '19 at 1:33
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 19:58

Bridge use frames, Bridge is a layer 2 Device and it does not use packets. Packet are used by layer 3 devices generally routers.


Some vendor products may operate (with regards to forwarding traffic) as a bridge but still have the ability to inspect and drop traffic based on higher layer information. For example, a Cisco Adaptive Security Appliance can operate in bridging mode or routing mode, but still inspect and drop traffic based on layer-4 (or sometimes higher) information. Some Cisco switches can also filter traffic by IP address or TCP/UDP port on a layer-2 switchport.

In theory, a router should only be able to filter based on layer-3 information, but every recent “enterprise” router supports stateless access-lists with the ability to filter on IP protocol and tcp/udp port.


The major difference is which (current) role the filtering device has in a network.

It can be a router, then it's a network-layer device, or a bridge, then it's a link-layer device. The main point is that all traffic to be controlled/filtered must run through that device.

Technically, firewall and security functions need to inspect the network (L3), the transport (L4) and the application layer (L7) - the more, the better. Of course, you can filter by any layer, regardless of whether it's a switching ("transparent", "on-wire") or a routing firewall. It only depends on the capabilities of that firewall. Many firewalls can use either mode, sometimes the mode limits the feature set.

If your question aims at filtering in switches (L2 or L3): these ACLs normally use L3 and L4 information only. These can e.g. limit DNS queries to outside servers or deny SMTP to unknown servers but they can't filter by URL or HTTP host name, or identify malware.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.