Editing Broadcast domain (section)

==Broadcast domain control==
With a sufficiently sophisticated switch, it is possible to create a network in which a broadcast domain is strictly controlled. One implementation of this concept is a [[private VLAN]]. Another implementation is possible with [[Linux]] and [[iptables]]. One analogy is that by creating multiple VLANs, the number of broadcast domains increases, but the size of each broadcast domain decreases. This is because a [[VLAN]] defines a broadcast domain.

This is achieved by designating one or more ''provider'' nodes, either by MAC address or switch port. Broadcast frames are allowed to originate from these sources and are sent to all other nodes. Broadcast frames from all other sources are directed only to the provider nodes. Traffic from other sources not destined to the provider nodes ([[peer-to-peer]] traffic) is blocked.

The result is a network based on a nominally shared transmission system; like Ethernet, but in which [[client (computing)|client]] nodes cannot communicate with each other, only with the provider. Allowing direct data link layer communication between client nodes exposes the network to various security attacks, such as [[ARP spoofing]].