|
|
4.3 | Switch Operation | ||
| 4.3.4 | How switches and bridges filter frames |
|
Bridges are capable of filtering frames based on any Layer 2 fields. For example, a bridge can be programmed to reject, not forward, all frames sourced from a particular network. Because link layer information often includes a reference to an upper-layer protocol, bridges can usually filter on this parameter. Furthermore, filters can be helpful in dealing with unnecessary broadcast and multicast packets. Once the bridge has built the local address table, it is ready to operate. When it receives a frame, it examines the destination address. If the frame address is local, the bridge ignores it. If the frame is addressed for another LAN segment, the bridge copies the frame onto the second segment.
Basic filtering keeps local frames local and sends remote frames to another LAN segment. Filtering on specific source and destination addresses performs the following actions:
Both types of filtering provide some control over internetwork traffic and can offer improved security. Most Ethernet bridges can filter broadcast and multicast frames. Occasionally, a device will malfunction and continually send out broadcast frames, which are continuously copied around the network. A broadcast storm, as it is called, can bring network performance to zero. If a bridge can filter broadcast frames, a broadcast storm has less opportunity to act. Today, bridges are also able to filter
according to the network-layer protocol. This blurs the demarcation
between bridges and routers. A router operates on the network layer
using a routing protocol to direct traffic around the network. A
bridge that implements advanced filtering techniques is usually called
a brouter. Brouters filter by looking at network layer information
but they do not use a routing protocol.
|