Linux Bridges: Building a Software Switch
A virtual Ethernet (veth) pair can connect exactly two endpoints. But modern systems rarely contain only two network devices. Containers, virtual machines, and network namespaces often need to communicate with many other devices on the same Layer 2 network. This is the job of a Linux bridge—a software implementation of an Ethernet switch.
Learning Objectives
By the end of this chapter, you will be able to:
- Understand what a Linux bridge is
- Explain how a bridge differs from a router
- Create and manage Linux bridges
- Connect multiple network namespaces to a bridge
- Observe MAC address learning and frame forwarding
- Inspect the bridge forwarding database (FDB)
- Troubleshoot bridge connectivity issues
- Understand how Docker, KVM, and Kubernetes use Linux bridges
The Problem
In the previous chapter, we connected two namespaces using a veth pair.
Namespace A
|
vethA
==================
vethB
|
Namespace B
This works well for two endpoints.
Now suppose we have three namespaces.
Namespace A
Namespace B
Namespace C
Can we connect them using veth pairs?
A <------> B
A <------> C
B <------> C
Technically, yes.
But notice what happens as the number of devices increases.
Four namespaces require six veth pairs.
Five namespaces require ten.
Ten namespaces require forty-five.
The number of required links grows rapidly.
This is not how real Ethernet networks are built.
How Physical Networks Solve This Problem
Imagine connecting ten physical servers.
You would never run an Ethernet cable between every pair of servers.
Instead, you connect each server to a switch.
Ethernet Switch
+----------------------+
| |
+--+--+--+--+--+--+----+
| | | | |
| | | | |
PC1 PC2 PC3 PC4 PC5
Each device has one cable.
The switch decides where each frame should go.
Linux provides the exact same concept in software.
What Is a Linux Bridge?
A Linux bridge is a software implementation of a Layer 2 Ethernet switch.
Instead of connecting physical Ethernet ports, it connects Linux network interfaces.
Linux Bridge
+-------------------+
| br0 |
+---+----+----+-----+
| | |
veth1 veth2 eth0
Every connected interface is called a bridge port.
The bridge receives Ethernet frames on one port and forwards them to another based on the destination MAC address.
Bridge vs Router
A bridge operates at Layer 2.
A router operates at Layer 3.
The difference is fundamental.
| Bridge | Router |
|---|---|
| Forwards Ethernet frames | Forwards IP packets |
| Uses MAC addresses | Uses IP addresses |
| Maintains an FDB (MAC table) | Maintains a routing table |
| Does not decrement TTL | Decrements TTL |
| Does not change IP addresses | May perform NAT |
| Devices remain in the same subnet | Connects different subnets |
A bridge extends an Ethernet network.
A router connects different IP networks.
Building Our First Bridge
Create a bridge named br0.
sudo ip link add br0 type bridge
Verify:
ip link show br0
Example:
7: br0: <BROADCAST,MULTICAST>
Bring it up.
sudo ip link set br0 up
Now Linux has a software Ethernet switch.
At this point, however, it has no ports connected.
Creating Two Namespaces
Create two namespaces.
sudo ip netns add blue
sudo ip netns add green
Enable loopback.
sudo ip netns exec blue ip link set lo up
sudo ip netns exec green ip link set lo up
Create Two veth Pairs
Each namespace needs one connection to the bridge.
blue-veth <------> blue-host
green-veth <------> green-host
Create them.
sudo ip link add blue-veth type veth peer name blue-host
sudo ip link add green-veth type veth peer name green-host
Move One End into Each Namespace
Move the namespace side.
sudo ip link set blue-veth netns blue
sudo ip link set green-veth netns green
Current topology:
Namespace blue Host
blue-veth -------- blue-host
Namespace green
green-veth ------ green-host
The host-side interfaces remain in the initial namespace.
Attach Interfaces to the Bridge
Attach the host interfaces.
sudo ip link set blue-host master br0
sudo ip link set green-host master br0
Verify.
bridge link
Example:
blue-host
green-host
These interfaces are now bridge ports.
Bring Everything Up
Host interfaces:
sudo ip link set blue-host up
sudo ip link set green-host up
Namespace interfaces:
sudo ip netns exec blue ip link set blue-veth up
sudo ip netns exec green ip link set green-veth up
Assign IP Addresses
Blue:
sudo ip netns exec blue ip addr add 192.168.100.10/24 dev blue-veth
Green:
sudo ip netns exec green ip addr add 192.168.100.20/24 dev green-veth
Topology:
+-------------+
| br0 |
+------+------+
|
+---------+---------+
| |
blue-host green-host
| |
================ ================
blue-veth green-veth
| |
Namespace blue Namespace green
Testing Connectivity
Ping from blue.
sudo ip netns exec blue ping 192.168.100.20
Output:
64 bytes from 192.168.100.20
The bridge forwards the Ethernet frames exactly like a physical switch.
What Actually Happened?
Let's follow the first packet.
Application
↓
TCP/IP Stack
↓
blue-veth
↓
blue-host
↓
Linux Bridge
↓
green-host
↓
green-veth
↓
TCP/IP Stack
↓
Application
Notice something important.
The bridge never looked at the IP address.
It forwarded the frame using only Ethernet information.
The Forwarding Database (FDB)
Physical switches maintain a MAC address table.
Linux bridges do the same.
Display it.
bridge fdb show
Example:
52:54:00:11:22:33 dev blue-host
52:54:00:44:55:66 dev green-host
This is called the Forwarding Database (FDB).
It tells the bridge which MAC addresses are reachable through each port.
How MAC Learning Works
Suppose the bridge has just been created.
Initially, its forwarding table is empty.
Bridge
FDB
(empty)
Blue sends the first frame.
Source MAC:
52:54:00:11:22:33
The bridge learns:
52:54:00:11:22:33
↓
blue-host
Later, Green replies.
52:54:00:44:55:66
↓
green-host
Now the table becomes:
MAC Address Port
52:54:00:11:22:33 blue-host
52:54:00:44:55:66 green-host
From this point onward, the bridge knows exactly where each destination is located.
This process is called MAC learning.
Unknown Unicast Traffic
What happens if the bridge receives a frame for an unknown MAC address?
It floods the frame.
Unknown Destination
Bridge
+-----+-----+-----+
Port1 Port2 Port3
Every port except the incoming one receives the frame.
Once the destination replies, the bridge learns where it is.
This behavior is identical to a physical Ethernet switch.
Broadcast Traffic
Broadcast frames are always flooded.
Examples include:
- ARP Requests
- DHCP Discover
- IPv6 Neighbor Discovery (multicast)
When Blue sends an ARP request:
Who has 192.168.100.20?
The bridge forwards that frame to every bridge port except the sender.
Green receives the request and responds.
The bridge then learns Green's MAC address.
Capturing Traffic
Observe the bridge in action.
Terminal 1:
sudo tcpdump -i blue-host
Terminal 2:
sudo tcpdump -i green-host
Terminal 3:
sudo ip netns exec blue ping 192.168.100.20
Observe:
- ARP Request
- ARP Reply
- ICMP Echo Request
- ICMP Echo Reply
The bridge simply forwards Ethernet frames.
Bridge Ports
Show bridge ports.
bridge link
Example:
blue-host
green-host
Detailed information:
bridge -d link
This displays bridge-specific information such as state and flags.
Interfaces Attached to a Bridge
Check interface relationships.
ip link show master br0
Example:
blue-host
green-host
This is useful when troubleshooting large systems.
Assigning an IP Address to the Bridge
A bridge is itself a network interface.
It can have an IP address.
sudo ip addr add 192.168.100.1/24 dev br0
Now the host becomes another device on the same Layer 2 network.
Host
192.168.100.1
br0
|
+----------+-----------+
| |
Namespace blue Namespace green
This is commonly used when the host must communicate with connected containers or virtual machines.
Where Linux Bridges Are Used
Linux bridges are used extensively throughout modern infrastructure.
- Docker (default bridge network)
- KVM/libvirt
- LXC/LXD
- Network emulation labs
- Some CNI plugins
Although some environments now use Open vSwitch or eBPF-based networking, the Linux bridge remains one of the most important networking components in the kernel.
Common Mistakes
Forgetting to Enable Interfaces
Creating interfaces does not automatically enable them.
Always bring interfaces up.
ip link set <interface> up
Forgetting to Attach Interfaces
Simply creating a veth pair does not connect it to the bridge.
Use:
ip link set <interface> master br0
Assigning IP Addresses to the Wrong Interface
When using a bridge, IP addresses are usually assigned to:
- the namespace interface, or
- the bridge itself.
The host-side veth interfaces normally do not require IP addresses.
Confusing Bridges with Routers
A bridge does not route packets between different IP networks.
If two namespaces belong to different subnets, a router is required.
We'll build one later in this book.
Cleaning Up
Delete the namespaces.
sudo ip netns delete blue
sudo ip netns delete green
Delete the bridge.
sudo ip link delete br0
Deleting the bridge automatically detaches its ports.
Key Takeaways
- A Linux bridge is a software implementation of an Ethernet switch.
- Bridge ports can be physical interfaces, veth interfaces, TAP devices, or other supported network interfaces.
- The bridge forwards Ethernet frames based on destination MAC addresses using its Forwarding Database (FDB).
- Unknown unicast and broadcast traffic are flooded to all bridge ports except the incoming port.
- Linux bridges operate entirely at Layer 2 and do not perform routing or NAT.
- A bridge is itself a network interface and can have an IP address assigned when the host needs to participate in the connected network.
- Docker, KVM, LXC, and many virtualization platforms rely on Linux bridges to interconnect virtual workloads.
Coming Next
So far, we've learned the three fundamental building blocks of Linux virtual networking:
- Network namespaces provide isolation.
- veth pairs provide point-to-point connectivity.
- Linux bridges provide Layer 2 switching.
In the next chapter, we'll combine these primitives to build a complete virtual network. Starting from an empty Linux system, we'll create multiple isolated hosts, connect them to a bridge, assign IP addresses, and observe packets flowing exactly as they would across a physical Ethernet network.