Collision Domains, Broadcast Domains, and Loops

Two different rooms, two different questions

In the last guide we watched a switch learn where every machine sits and deliver each frame to exactly the right port. That story answered "where does this frame go?" But there are two other questions a network engineer asks about any LAN, and beginners constantly tangle them together. The first is: who has to take turns speaking, because if two of them talk at once the words collide? The second is: who hears it when someone shouts to everybody at once? These sound similar, but they are about completely different things, and the device that fixes one does not fix the other.

The first question is about a collision domain: the group of devices that share one channel and must take turns, so that two simultaneous transmissions step on each other. The second is about a broadcast domain: the group of devices that all receive a frame addressed to everybody. A collision domain is about contention for airtime; a broadcast domain is about reach. Keep them in separate mental boxes and the rest of this guide clicks into place; mix them up and switches, hubs, routers, and VLANs become a confusing soup.

Collision domains: who has to take turns

Picture an old-fashioned party-line phone, or a small room where only one person can speak at a time. If two people start a sentence at the same instant, their words garble and both must stop and try again. That group of people forced to take turns is one collision domain. On the original shared-coax Ethernet, or on anything hung off a hub, every machine sits in one such room: two simultaneous transmissions physically overlap on the wire and corrupt each other.

To survive a shared channel, the machines run CSMA/CD — carrier-sense multiple access with collision detection. In plain words: listen before you talk; if the channel is busy, wait; if you start talking and hear a collision anyway, stop immediately, wait a random backoff time, and try again. It works, but the more machines crowd into one collision domain, the more they collide and the less useful bandwidth each one actually gets. Eight busy machines on one 100 Mbps hub do not get 100 Mbps each; they fight over one shared 100 Mbps and the real throughput sinks well below it.

This is exactly why the switch from the last guide replaced the hub. A switch gives every device its own cable and its own port, so each port is its own collision domain. Better still, a modern switched link runs full-duplex: separate wire pairs (or fibers) carry send and receive at the same time, so there is literally nothing to collide with. A 1 Gbps full-duplex link can push roughly 1 Gbps each way at once, and CSMA/CD becomes unnecessary — collision detection is simply switched off on a link that cannot collide. Half-duplex, where both directions share one channel and must take turns, now survives mainly on shared media like a hub or a radio.

Broadcast domains: who hears the shout

Now the second question. Sometimes a host does not address one machine but everybody at once — a frame whose destination MAC is the special all-ones address ff:ff:ff:ff:ff:ff, meaning "everyone on this LAN." A switch handles a broadcast very differently from a normal frame: instead of one targeted lookup, it floods the broadcast out every port except the one it arrived on. So even though the switch gave each port its own collision domain, the broadcast still reaches all of them. The whole switch — indeed a whole tree of switches cabled together — is one broadcast domain.

Broadcasts are not a bug; a LAN cannot function without them. When your laptop knows an IP address but needs the matching MAC to build a frame, ARP broadcasts "who has 192.168.1.20?" When a freshly booted device has no address at all, DHCP broadcasts to find a server. (Those two helper protocols get their own guide later in this rung.) The trouble is volume: every broadcast interrupts every machine in the domain, which must at least look at the frame to decide it is not interested. Put a few thousand devices in one flat broadcast domain and that constant background shouting wastes real bandwidth and CPU.

So what stops a broadcast? Not another switch — a switch floods broadcasts onward. A broadcast stops at a router. A router works one layer up, on IP addresses, and it simply does not forward a layer-2 broadcast onto another network; it is a wall that a shout cannot climb. The other way to bound a broadcast domain is a VLAN, which carves one physical switch into several logical broadcast domains in software — that is the whole subject of the next guide. For now, just lock in the contrast: switches and hubs and bridges all leave the broadcast domain whole; only a router (layer 3) or a VLAN splits it.

The loop that melts a network

Here is where the broadcast domain turns dangerous. People wire spare cables between switches for backup — a sensible instinct. But two switches joined by two cables, or three switches cabled in a triangle, form a physical loop, and a loop is deadly at layer 2. Recall a crucial fact from the network layer: an IP packet carries a TTL, a hop counter that kills it after too many hops. An Ethernet frame has no such counter. Nothing in the frame ever says "you have travelled too far."

Now send one broadcast into a loop. Switch A floods it to switch B; B floods it back to A and onward; A floods it again; the single frame circles forever, and because each switch also floods it out other ports, the number of copies multiplies on every lap. Within seconds the loop is screaming with billions of copies of one frame — a broadcast storm — and the network drowns. To make it worse, the constant flooding scrambles the MAC address tables, so even normal traffic stops being delivered. A single mis-plugged backup cable can take down an entire building's network in moments.

Spanning Tree: keep the cables, kill the loop

We want the backup cables for resilience, but we cannot allow a loop. The classic answer is the Spanning Tree Protocol (STP). Its job is elegant: leave every redundant cable physically plugged in, but have the switches agree to logically switch some ports off, so that exactly one active path connects any two points. The active topology becomes a tree — a shape with no loops — that still spans (reaches) every switch. If an active link later dies, a switched-off port wakes up to restore the path, which is exactly why the spare cables were there.

1. Elect a root. The switches exchange tiny messages (called BPDUs) and pick one switch as the root of the tree — by convention the one with the lowest bridge ID.
2. Find the best path to the root. Every other switch computes its lowest-cost path back to the root and keeps the one port on that best path active (its root port).
3. Block the rest. Any port that would create a second path to somewhere is put into a blocking state: it carries no data frames, so no loop can form, but it keeps listening.
4. Heal on failure. If an active link breaks, the switches notice through the missing BPDUs, and a previously blocked port transitions to forwarding to take over the path.

Be honest about the cost, though. STP buys loop-freedom by leaving expensive links idle in the blocking state until a failure happens — you paid for those cables and most of the time they carry nothing. Classic STP also reconverged slowly, taking tens of seconds after a change, which is why it was replaced in practice by Rapid Spanning Tree (RSTP). Two better answers exist when you actually want to use all the links at once. One is link aggregation, which we meet next; the other, in big datacenters, is fabric designs like leaf-spine with equal-cost multipath that route over many links simultaneously instead of blocking them.

Link aggregation bundles several physical cables between two devices into one logical link with a single identity. Crucially, because STP sees the bundle as one link rather than several parallel ones, it does not treat the extras as a loop to block — so all the cables carry traffic at once. Bundle four 10 Gbps links and you get about 40 Gbps of aggregate capacity plus survival if one cable fails. The honest caveat matters: a single conversation is hashed onto one member link, so one giant file copy tops out near one member's speed, not the whole bundle. Aggregation raises total throughput across many flows; it does not speed up any one flow.

Putting the two domains together

Let us draw a tiny network and count both kinds of domain at once, because the count is where the ideas finally lock together. The diagram below has a hub joining three old PCs, the hub plugged into one switch port, two more PCs on their own switch ports, and the switch uplinked through a router. Walk it slowly and notice how the two questions give two different answers.

        [ Router ]            <- broadcasts STOP here
            |
        [ Switch ]   port 2 --- PC-D
         | port 1    port 3 --- PC-E
        [ Hub ]
       /   |   \
    PC-A  PC-B  PC-C

Collision domains:
  - Hub + PC-A,B,C  ......... 1 (they all share, take turns, CSMA/CD)
  - PC-D link ............... 1 (its own port, full-duplex)
  - PC-E link ............... 1 (its own port, full-duplex)
  - Switch <-> Router link .. 1
                              = 4 collision domains

Broadcast domains:
  - everything below the router = 1 (a switch floods broadcasts;
                                      the router blocks them)

Read off the answers. Collision domains: the hub group of PC-A, PC-B, and PC-C is one shared room where they take turns; each of PC-D's, PC-E's, and the router's switch links is its own collision domain — four in all. Broadcast domains: a broadcast from any of those machines floods across the hub and the whole switch and reaches everyone below the router, but the router refuses to pass it on, so the entire picture is just one broadcast domain. Add a second router (or split the switch into VLANs) and you would finally get a second broadcast domain.

That single picture is the whole guide in miniature. A switch shrinks collision domains down to one per port and full-duplex erases collisions entirely; broadcasts still flood across every switch until a router or a VLAN stops them; and any loop in that flat layer-2 fabric must be tamed by Spanning Tree because frames have no hop count to save them. Hold these three facts and the next guide — slicing one switch into many VLANs — will feel like the obvious next move.