Other switches, loops and troubleshooting

Every switch vendor uses the same concepts with slightly different words. This lab's switch is a Linux bridge (the same thing inside VyOS, Proxmox and most open-source routers); here's how the ideas map:

Concept	Linux bridge (this lab)	Common names elsewhere
VLAN-aware switch	vlan_filtering 1	(always on)
Access port in VLAN 10	bridge vlan add dev eth1 vid 10 pvid untagged	"access VLAN 10", "untagged in VLAN 10"
Trunk carrying VLANs 10 and 20	bridge vlan add dev eth4 vid 10, vid 20	"trunk, allowed VLANs 10,20", "tagged in VLAN 10 and 20"
The untagged VLAN on a trunk	pvid untagged on the trunk port	"native VLAN"
MAC address table	bridge fdb show	"MAC address table", "FDB"

Loops, and a story from this lab

Connect two switch ports together, directly or through other switches, and you've built a loop. A broadcast goes round it forever, multiplying at every switch, until the network is saturated: a broadcast storm. The Spanning Tree Protocol (STP) prevents this by finding loops and blocking one port in each. Most managed switches have it on by default (a Linux bridge doesn't). Leave it on.

The first version of this lab used Docker networks as the cables. Docker's bridges send broadcasts back to the port they came from (the VyOS labs had already shown this), so every port of the switch was effectively looped back to itself. Within seconds of the first ARP broadcast, Docker itself stopped responding, the classic symptom of a storm, and only a restart brought it back. The lab was rebuilt with plain virtual cables (veth pairs) instead. Loops are not a theoretical problem.

Checklist and troubleshooting

Symptom	Look at	Usual cause
Two hosts on the same switch can't talk	Their IP addresses and prefix lengths; their VLANs	Different subnets with no gateway, or different VLANs
Host can't reach its gateway	The VLAN on the host's port, and the VLANs allowed on the trunk	The VLAN is missing from the trunk, or the port is in the wrong VLAN
Gateway reachable, other VLANs not	The host's default route; the router's subinterfaces	No default gateway on the host, or a missing subinterface on the router
Everything slow, switches at 100% CPU	Port counters; STP state	A loop, and a broadcast storm
A device moved and stopped working	The switch's MAC table	It's now on a port in a different VLAN