LearnLinux › cmds › commands

bridge

Manage Linux Ethernet bridges and the kernel bridge database: ports, VLAN filtering, forwarding database (FDB/MAC table), and link-layer settings. Part of iproute2.

Category: Networking L2 Bridging FDB / MAC table VLAN Aware iproute2

What it does

bridge inspects and configures Linux kernel bridging features: bridges, bridge ports, and the forwarding database (MAC learning table). It’s especially useful on servers acting as hypervisors, container hosts, or software switches.

How it works (mechanical)

A Linux bridge is a Layer‑2 switch implemented in the kernel. Frames entering a bridge port are: learned (source MAC → ingress port), then forwarded based on the destination MAC using the FDB. Unknown destinations are flooded to other ports (subject to settings). The bridge command talks to the kernel bridge subsystem to show/modify this state.

  • FDB (Forwarding Database) stores learned MAC → port mappings
  • Ports can be configured for STP, hairpin mode, isolation, and VLAN filtering
  • VLAN-aware bridges can keep separate forwarding domains per VLAN

10 Practical Examples

# 1) Show bridges and their ports
bridge link
# 2) Show details for bridge devices (bridge "show")
bridge -d link show
# 3) Show the forwarding database (MAC table)
bridge fdb show
# 4) Show FDB entries for one bridge port
#    (replace vnet0 with your port name)
bridge fdb show dev vnet0
# 5) Add a static FDB entry (pin MAC to port)
#    (useful for special cases; avoid unless you need it)
sudo bridge fdb add 00:11:22:33:44:55 dev vnet0 master static
# 6) Delete a static FDB entry
sudo bridge fdb del 00:11:22:33:44:55 dev vnet0 master
# 7) Show VLAN configuration (VLAN-aware bridge)
bridge vlan show
# 8) Add VLAN 10 to a bridge port (tagged)
#    (replace br0 + eth1 with your bridge/port)
sudo bridge vlan add dev eth1 vid 10 master
# 9) Make VLAN 10 untagged (PVID) on a port (common access-port behavior)
sudo bridge vlan add dev eth1 vid 10 pvid untagged
# 10) Toggle hairpin mode on a port (VM/containers: allow reflection back out same port)
sudo bridge link set dev vnet0 hairpin on

Notes & Gotchas

  • Creation is usually done with ip: e.g., ip link add br0 type bridge. Use bridge to inspect/tune.
  • VLAN filtering: VLAN commands only matter if the bridge is VLAN-aware. Verify bridge settings and VLAN filtering state.
  • STP: Spanning Tree Protocol prevents loops, but can block ports. Know whether STP is enabled on your bridge.
  • Static FDB entries: can override learning; mistakes can blackhole traffic.
  • Observability: pair with tcpdump -e to see MAC/VLAN tags on-wire.

Historical Context

Linux bridging started as a simple software switch and grew into a serious L2 feature set used for virtualization and container networking. The bridge command is part of iproute2 and effectively replaces older approaches that relied heavily on brctl.

Modern Equivalent / Related Tools

  • ip — create bridges, set links up/down, manage addresses
  • brctl — older bridge tool (bridge-utils), largely replaced
  • nft — filtering at L2/L3/L4 (including bridge family rules)
  • tc — shaping/policing on bridge ports
  • tcpdump — observe frames, VLAN tags, ARP, etc.