Overview
A broadcast domain is the set of devices that will all receive a broadcast frame sent by any one of them. Understanding broadcast domains — and how they are divided — is key to network design, performance, and segmentation-based security.
Learning objectives
- Define broadcast and collision domains.
- Explain how switches and routers affect broadcast domains.
- Understand VLANs as a way to segment broadcast domains.
Core concept
A broadcast is a frame addressed to all hosts on a local segment (destination MAC FF:FF:FF:FF:FF:FF); ARP requests are a common example. A broadcast domain is the group of devices that receive such a frame.
- Switches forward broadcasts to all their ports, so by default all devices on a switch (or set of connected switches) share one broadcast domain.
- Routers do not forward broadcasts — they separate broadcast domains. Each router interface bounds a broadcast domain.
How it works
Because broadcasts reach everyone in the domain, large broadcast domains waste bandwidth and reduce privacy (more hosts see more broadcast traffic). Networks are therefore segmented into smaller broadcast domains. The modern way to do this on switches is the VLAN (Virtual LAN): a VLAN logically divides one physical switch into multiple separate broadcast domains, so hosts in VLAN A cannot directly reach hosts in VLAN B without going through a router/Layer 3 device.
(Historically, "collision domains" — where simultaneous transmissions could clash — were relevant with hubs; switches largely eliminated collisions by giving each port its own collision domain.)
Practical example
A company puts its finance and guest Wi-Fi devices on the same switch but in different VLANs. Broadcasts from a guest device stay within the guest VLAN and never reach finance machines, and vice versa. To allow any needed communication, traffic must pass through a router/firewall that can enforce rules. One physical switch, two isolated broadcast domains — improving both performance and security.
Cybersecurity relevance
Segmenting broadcast domains with VLANs is a core network segmentation technique: it limits how far an attacker or malware on one segment can reach, and it contains broadcast-based reconnaissance and some Layer 2 attacks. It directly supports defense in depth and least privilege at the network level.
Common mistakes
- Thinking switches separate broadcast domains — they forward broadcasts; routers (and VLAN boundaries) separate them.
- Running one large flat network (single broadcast domain), which harms performance and lets attacks spread freely.
Key takeaways
- A broadcast domain is the set of devices that receive a broadcast frame; switches forward broadcasts, routers separate them.
- VLANs segment one physical switch into multiple isolated broadcast domains.
- Segmentation improves performance and is a key security control that limits an attacker's reach.
Check your understanding
- Which device separates broadcast domains: a switch or a router? Why?
- How does putting two groups of hosts in separate VLANs improve security?