WHY and HOW do routers and vlans break broadcast domains?

Question

Everybody says routers (and vlans) break broadcast domains, but nobody goes into WHY that is, it seems. What's the router logic? Say I have three routers on my lan, with one main router and the other two merely bridged to the first (not creating different networks with different addresses, so they're not acting as gateways). Let's say the main router sends out a broadcast. The packet gets encapsulated into a frame, and the switches will all forward the broadcast. But will these other routers, behind which I might have some more switches and devives, do the same?

What I want to understand is : do routers only break broadcast domains when they're acting as gateways and actually route between networks, in which case they'll discard the broadcast by decapsulating the frame and seeeing the address in the packet header (?), or do they always break broadcast domains, even when they're merely used more like switches, for their ports, behind a gateway?

And HOW exactly do Vlans break broadcast domains? If vlans abstract the underlying switch and logically divide it- say, in half, why would the resulting vlans break the broadcast domain? Even if they are perceived as different switches, don't interconnected switches forward broadcasts? How does it all work here ?

Thanks in n advance

Answer 1

Let's talk about it using this topology of three networks (red / orange / blue):

A Router's primary function is to facilitate communication between IP networks. Which means if A wants to speak to D or B, the Router must be used.

However, a Broadcast by definition is a message intended to be sent to everyone within the sender's local network.

If Host A send a broadcast, then Host A means for the packet to only be delivered to Host C, and the Router on the left -- and no one else. The Router, by definition, does not need to, and should not, forward that broadcast anywhere.

So it isn't so much that the Router is "breaking" the Broadcast domain as much as it is that the Router is the natural boundary for the Broadcast domain. It is analogous to a wall being the natural boundary of a room.

If a Router is merely "switching" between it's interfaces and not actually routing, then you can safely consider that router as behaving like a Switch -- who's primary purpose is to facilitate communication WITHIN networks. As such, a Switch will not limit a Broadcast in any way, and in fact will help it along by flooding the broadcast out every port.

---

Edit: forgot your VLANs question:

And HOW exactly do Vlans break broadcast domains? If vlans abstract the underlying switch and logically divide it- say, in half, why would the resulting vlans break the broadcast domain? Even if they are perceived as different switches, don't interconnected switches forward broadcasts? How does it all work here ?

VLAN's simply break up one switch into multiple "virtual" switches. That image above with the three "switches" can also be represented as two physical switches with three VLANs:

In fact, you could consider this image the "Physical Topology" and the image above it as the "Logical Topology". They are essentially the same topology.

In this image, if the switches receive traffic (to include broadcasts) on VLAN 10 ports, they will only send that traffic out other VLAN 10 ports -- this is by definition of what VLANs do.

So whether there is only 1 switch or many switches in a row, Switches still only facilitate communication WITHIN networks, meaning across any number of switches you still have a single IP network.

---

Disclaimer: The image and links above are to my own blog. The blog is not monetized. I make no profit from you visiting and am providing the links to help the reader

Answer 2

It might be helpful to define a broadcast domain here. In simplest terms, when a host generates a braodcast frame, all the nodes that the frame can reach in the network without been dropped by a network device is a part of one broadcast domain.

Routers do not forward broadcast packets, For eg: Lets say a router has 2 interfaces connected to 2 hosts. If interface 1 gets a broadcast frame, the router will not forward that frame out of the other interface. Hence routers end or break the broadcast domain.

Why you ask? A couple of reasons...

1. One of the most common use case of broadcast frames is address learning (eg ARP ). When you send frame out from a host, you need the destination MAC address of the next hop (that is the next layer 3 device). Its important to emphasize that the packet might be intended for a host that is 100 hops away, we still put the destination MAC address of the NEXT layer 3 hop. Hence we don't really need broadcast frames to cross broadcast domains, their use is confined to the LAN itself (Ohh and also LAN is a broadcast domain :) )

2. But you can argue, even if there is no real use of forwarding broadcast frames across routers, whats the harm ? First of all, thats the way networks are designed, so it would break the principles at layer 3. Even more, they would create huge network overload. if all routers started forwarding all frames out of all interfaces, just imagine the amount of overload it might create in the network.

Answer 3

Routers don't break broadcast domains. They forward unicasts between them.

A router forwards packets by their destination address and how that matches its routing table.

Switches forward (flood) broadcasts. Routers don't (unless it's a directed broadcast and the router is explictly configured to forward it).

VLANs partition a network into seperated broadcast domains. That way you can isolate segments and control communication on the routers required between them. You could use separate switches but VLANs allow you to share switches and the links between them for all VLANs, but still keep each one separate.

The "break a broadcast domain" phrase originates from the era of bus-wired or repeated Ethernet where you "broke" a large collision domain (L1 segment) down by inserting a bridge/switch into your wire. Accordingly, a broadcast domain (L2 segment) is "broken" by replacing a switched connection by a router, effectively stopping broadcasts and direct communication at that point.

Answer 4

WHY and HOW do routers break broadcast domains? (and switches don't, unless they employ VLANs etc).

The answer is actually a simple one, and it boils down to protocol implementation and the netoworking function that routers/switches are supposed to perform.

I've taken the liberty f including this image from TCP/IP illustrated, vol.1.

As shown above, end systems (hosts) implement the whole protocol stack, up to the application layer, while switches implement up to (and including) layer2 -datalink, while routers up to (and including) layer3.

Routers and switches as abstractions

Now, someone might point out that there are so-called layer-3 switches, for example. The answer to this is that 'router' and 'switch' are best thought of as abstractions rather than specific networking equipment.

What I mean by that is that a router is identified by the function it performs - routing and forwarding at layer3 - rather than the physical device that normally represents a router. To elaborate on this (or otherwise I might only muddy the water), a router running OpenWrt, for example, is quite obviously not limited in its protocol implementation to layer3, as it can run most of what a Linux end system typicallly can.

Additionally, all routers will typically have a Web Interface, which means they run a web server, which entails the transport and the application layers. Switches will sometimes have a Web UI too.

But this is misleading. Although Switches and Routers might implement the transport and application layers, they have nothing to do with their roles : switching and routing, respectively. These are just for management purposes and whatnot - this is what I mean by looking at switches and routers as functional abstractions. An end system can do IP forwarding and routing - and in that case, even though it IS an end system, it ACTS like a router - it performs the FUNCTION of a router.

I made a point of talking about this because you seemed to have the right idea ('act as gateways' etc, but hadn't fully grasped it yet).

A router that acts as a bridge, is, for all intents and purposes in this context, not a router, but a bridge, since that's the function it performs. Since only a 'router' (an actual router, or a device acting as one - again, it could just as well be an end system implementing routing functionality) breaks a broadcast domain and you posited that they were acting as bridges instead, then no, they wouldn't break a broadcast domain.

And how does a router 'break' a broadcast domain in the first place?

Let's say we have a router with two interfaces, addressed at layer 3 as 10.10.10.0/24 and 192.168.1.0/24, with 4 hosts connected to it via wired Ethernet. Host A is 10.10.10.10.

Let's take the scenario where host A sends out a broadcast packet (carrying ARP or whatever else):

• hostA builds up the packet, and ultimately encapsulates it into a datalink frame that gets pushed out by the NIC, addressed all Fs (ethernet broadcast)

• the frame reaches the router, the frame is a broadcast frame at the datalink layer - all Fs. What happens next is crucial. If this were a switch, the frame, being determined as a broadcast, would be forwarded out all interfaces except the one it originated from. But since this is a router, the frame gets decapsulated and passed up to the network layer. How are IP broadcasts addressed? It would be either 10.10.10.255 or 255.255.255.255 (referring to the current network), which will be determined by the source address - 10.10.10.10/24. This means that the router will determine that the broadcast is meant for the 10.10.10.0/24 network, and that's where it'll forward the packet, sending it out all the interfaces associated with this network.

What this means is that even though two devices connected to the same router are reachable at the datalink layer, and are part of the same broadcast domain at the datalink layer, they might not be so at the network layer. A router being a router will always decapsulate the packet and look at its header at layer 3, which might indicate that the two aforementioned devices are NOT in fact part of the same network, and so the broadcast is limited.

This is how routers 'break' broadcast domains.

Answer 5

It's useful to talk about switching (or VLANs) as layer-2 technologies, and routing as a layer-3 technology.

Hosts (PCs, printers, etc) connected to the same VLAN can communicate with each-other directly by sending Ethernet frames destined to each-other. Switches use the destination MAC address of frames to decide which port to send them to. If a switch doesn't know where a destination MAC is located, it sends that frame to all ports, a process called unknown unicast flooding. Switches learn of MAC address / port relationships only when they see traffic sourced by that MAC, and they maintain a MAC address table with individual 48-bit addresses. This generally scales well for hundreds or a few thousand hosts, but not more.

A router, on the other hand, is optimal for interconnecting larger networks of devices. The magic is IPv4 addresses are assigned based on network "location," not at random like MAC addresses are. A router can function on the Internet with knowledge of only what hosts are "downstream" of it -- say that's 192.0.2.0/24 in your office; and a default route 0.0.0.0/0 for reaching everything else. Just two routing table entries enable participation in the largest network -- the Internet.

There are many other differences between routers and switches, but this is the most crucial.