Dynamic ARP Inspection (DAI) — How It Works and How to Configure It
DAI validates every ARP packet against the DHCP snooping binding table and drops the forged ones, stopping ARP…
These two terms describe how far two different kinds of traffic problem spread through a network, and they are counted differently by different devices. Getting them straight explains why hubs disappeared, what a switch actually buys you, and why VLANs exist.
- A collision domain is the set of interfaces whose transmissions can collide with each other.
- A broadcast domain is the set of interfaces that receive a broadcast frame sent by any one of them.
The One-Line Rule
| Device | Collision domains | Broadcast domains |
|---|---|---|
| Hub / repeater | 1 (all ports share one) | 1 |
| Switch / bridge | One per port | 1 (or one per VLAN) |
| Router | One per interface | One per interface |
| Wireless access point | 1 per radio (shared medium) | 1 per SSID/VLAN |
Compressed: switches break up collision domains, routers break up broadcast domains, and VLANs let a switch break up broadcast domains too.
Collision Domains
A collision happens when two devices transmit on a shared medium at the same instant and their signals overlap, destroying both frames. Ethernet handled this with CSMA/CD: listen before transmitting, detect the collision if it happens, send a jam signal, wait a random backoff, retry.
This only occurs in half duplex. A device cannot send and receive simultaneously, so it has to share airtime with everyone else in the domain.
Why hubs were terrible
A hub repeats every incoming signal out of every other port. All eight ports are one collision domain. On a 10 Mbps hub with eight active hosts, they collectively share 10 Mbps — and the effective throughput drops well below that as collisions and backoffs multiply.
Why switches fixed it
A switch gives each port its own collision domain and runs full duplex, meaning a device can transmit and receive at the same time. With full duplex there is no shared medium and collisions cannot occur at all — CSMA/CD is disabled on the link.
This is why collision domains barely matter in a modern wired network: every port is its own, and every link is full duplex. The concept survives mainly in exams, in wireless (where the medium genuinely is shared), and as the explanation for a specific fault:
Duplex mismatch. If one side of a link is half duplex and the other is full, the half-duplex side detects collisions the full-duplex side does not care about. The link works — slowly and unreliably, with late collisions and CRC errors climbing. It is one of the classic “network is slow but not down” faults.
Switch# show interfaces GigabitEthernet0/5 | include duplex|collision|CRCBroadcast Domains
A broadcast frame is addressed to ffff.ffff.ffff and every device in the domain must receive and process it. Broadcasts are not a bug — ARP, DHCP Discover, and various discovery protocols all depend on them.
A switch floods broadcasts to every port in the VLAN. It does not stop them. Only a Layer 3 boundary — a router interface or an SVI — does.
Why oversized broadcast domains hurt
- Every host’s CPU processes every broadcast, even the irrelevant ones.
- Broadcast traffic scales with host count, and consumes bandwidth on every link.
- A broadcast storm — usually from a switching loop with no STP — saturates every link in the domain within seconds.
- Security: every device can reach every other device at Layer 2, so one compromised host has a flat path to everything.
Around 200–500 hosts is the usual practical ceiling for one broadcast domain, which is why enterprise networks are built from many small VLANs rather than one large flat network.
VLANs — the modern answer
A VLAN lets one physical switch host several independent broadcast domains. Ports in VLAN 10 never see VLAN 20’s broadcasts. Traffic between them must pass a router or a Layer 3 switch, where it can be filtered.
So a 24-port switch with three VLANs configured has 24 collision domains and 3 broadcast domains.
Worked Examples
Example 1 — one hub
An 8-port hub with 8 PCs: 1 collision domain, 1 broadcast domain.
Example 2 — one switch
A 24-port switch with 24 PCs, no VLANs: 24 collision domains, 1 broadcast domain.
Example 3 — switch with a hub attached
A 24-port switch, 23 PCs on individual ports, and port 24 connected to a 4-port hub with 4 PCs:
- Collision domains: 23 switch ports + 1 for the whole hub segment = 24
- Broadcast domains: 1
Example 4 — router joining two switches
A router with two interfaces, each connected to a 12-port switch, all ports populated:
- Collision domains: 12 + 12 (host ports) + 2 (router-to-switch links) = 26
- Broadcast domains: 2 — one per router interface
Example 5 — the exam favourite
A router with 3 interfaces. Interface 1 goes to a hub with 5 PCs. Interface 2 goes to a switch with 8 PCs. Interface 3 goes to a switch with 6 PCs configured across 2 VLANs.
- Collision domains: hub segment = 1 (the router-to-hub link is part of it); switch 2 = 8 host ports + 1 uplink = 9; switch 3 = 6 host ports + 1 uplink = 7. Total = 17
- Broadcast domains: 1 (hub side) + 1 (switch 2) + 2 (switch 3’s VLANs) = 4
The trick in these questions is remembering that the link between a router and a switch is itself a collision domain, and that each VLAN counts as its own broadcast domain regardless of how many switches carry it.
Wireless — Where Collisions Still Matter
WiFi is genuinely a shared, half-duplex medium: only one device on a channel can transmit at a time. Because a station cannot listen while transmitting, WiFi uses CSMA/CA — collision avoidance — with acknowledgements and optional RTS/CTS instead of detection.
So one access point radio is one collision domain shared by every client on it. This is why an access point with 40 clients performs far worse than a 40-port switch, and why adding APs on non-overlapping channels helps more than buying a faster one.
Frequently Asked Questions
Does a switch break up broadcast domains?
Not by default — it floods broadcasts to every port. It only creates separate broadcast domains when you configure VLANs.
Does a router break up collision domains?
Yes, each router interface is its own collision domain. But that is incidental; the reason you deploy a router is to separate broadcast domains.
Do collisions still happen on modern networks?
Not on full-duplex switched Ethernet — they are impossible there. They still occur on wireless, and they appear on wired links as a symptom of duplex mismatch.
How many broadcast domains does a Layer 3 switch create?
One per VLAN, since each VLAN interface (SVI) is a routed boundary.
Is a broadcast domain the same as a subnet?
In a correctly designed network they map one to one — one VLAN, one subnet, one broadcast domain. They are different concepts (Layer 2 versus Layer 3) but aligning them is standard practice, and not aligning them causes confusing failures.
What is the maximum size of a broadcast domain?
There is no protocol limit, only a practical one. Beyond a few hundred hosts, broadcast overhead and the blast radius of a loop make it a poor design. Segment with VLANs instead.
