1BRIDGE(8)                            Linux                           BRIDGE(8)
2
3
4

NAME

6       bridge - show / manipulate bridge addresses and devices
7

SYNOPSIS

9       bridge [ OPTIONS ] OBJECT { COMMAND | help }
10
11
12       OBJECT := { link | fdb | mdb | vlan | monitor }
13
14
15       OPTIONS := { -V[ersion] | -s[tatistics] | -n[etns] name | -b[atch]
16               filename | -c[lor] | -p[retty] | -j[son] | -o[neline] }
17
18       bridge link set dev DEV  [ cost COST ] [ priority PRIO ] [ state STATE
19               ] [ guard { on | off } ] [ hairpin { on | off } ] [ fastleave {
20               on | off } ] [ root_block { on | off } ] [ learning { on | off
21               } ] [ learning_sync { on | off } ] [ flood { on | off } ] [
22               hwmode { vepa | veb } ] [ mcast_flood { on | off } ] [
23               mcast_to_unicast { on | off } ] [ neigh_suppress { on | off } ]
24               [ vlan_tunnel { on | off } ] [ isolated { on | off } ] [
25               backup_port DEVICE ] [ nobackup_port ] [ self ] [ master ]
26
27       bridge link [ show ] [ dev DEV ]
28
29       bridge fdb { add | append | del | replace } LLADDR dev DEV { local |
30               static | dynamic } [ self ] [ master ] [ router ] [ use ] [
31               extern_learn ] [ sticky ] [ dst IPADDR ] [ src_vni SRC_VNI ] [
32               vni VNI ] [ port PORT ] [ via DEVICE ]
33
34       bridge fdb [ show ] [ dev DEV ] [ br BRDEV ] [ brport DEV ] [ vlan VID
35               ] [ state STATE ]
36
37       bridge mdb { add | del } dev DEV port PORT grp GROUP [ permanent | temp
38               ] [ vid VID ]
39
40       bridge mdb show [ dev DEV ]
41
42       bridge vlan { add | del } dev DEV vid VID [ tunnel_info TUNNEL_ID ] [
43               pvid ] [ untagged ] [ self ] [ master ]
44
45       bridge vlan [ show | tunnelshow ] [ dev DEV ]
46
47       bridge monitor [ all | neigh | link | mdb ]
48
49

OPTIONS

51       -V, -Version
52              print the version of the bridge utility and exit.
53
54
55       -s, -stats, -statistics
56              output more information. If this option is given multiple times,
57              the amount of information increases.  As a rule, the information
58              is statistics or some time values.
59
60
61       -d, -details
62              print detailed information about MDB router ports.
63
64
65       -n, -net, -netns <NETNS>
66              switches bridge to the specified network namespace NETNS.  Actu‐
67              ally it just simplifies executing of:
68
69              ip netns exec NETNS bridge [ OPTIONS ] OBJECT { COMMAND | help }
70
71              to
72
73              bridge -n[etns] NETNS [ OPTIONS ] OBJECT { COMMAND | help }
74
75
76       -b, -batch <FILENAME>
77              Read commands from provided file or standard input and invoke
78              them.  First failure will cause termination of bridge command.
79
80
81       -force Don't terminate bridge command on errors in batch mode.  If
82              there were any errors during execution of the commands, the
83              application return code will be non zero.
84
85
86       -c[color][={always|auto|never}
87              Configure color output. If parameter is omitted or always, color
88              output is enabled regardless of stdout state. If parameter is
89              auto, stdout is checked to be a terminal before enabling color
90              output. If parameter is never, color output is disabled. If
91              specified multiple times, the last one takes precedence. This
92              flag is ignored if -json is also given.
93
94
95       -j, -json
96              Output results in JavaScript Object Notation (JSON).
97
98
99       -p, -pretty
100              When combined with -j generate a pretty JSON output.
101
102
103       -o, -oneline
104              output each record on a single line, replacing line feeds with
105              the '\' character. This is convenient when you want to count
106              records with wc(1) or to grep(1) the output.
107
108
109

BRIDGE - COMMAND SYNTAX

111   OBJECT
112       link   - Bridge port.
113
114
115       fdb    - Forwarding Database entry.
116
117
118       mdb    - Multicast group database entry.
119
120
121       vlan   - VLAN filter list.
122
123
124   COMMAND
125       Specifies the action to perform on the object.  The set of possible
126       actions depends on the object type.  As a rule, it is possible to add,
127       delete and show (or list ) objects, but some objects do not allow all
128       of these operations or have some additional commands. The help command
129       is available for all objects. It prints out a list of available com‐
130       mands and argument syntax conventions.
131
132       If no command is given, some default command is assumed.  Usually it is
133       list or, if the objects of this class cannot be listed, help.
134
135
137       link objects correspond to the port devices of the bridge.
138
139
140       The corresponding commands set and display port status and bridge spe‐
141       cific attributes.
142
143
144   bridge link set - set bridge specific attributes on a port
145       dev NAME
146              interface name of the bridge port
147
148
149       cost COST
150              the STP path cost of the specified port.
151
152
153       priority PRIO
154              the STP port priority. The priority value is an unsigned 8-bit
155              quantity (number between 0 and 255). This metric is used in the
156              designated port an droot port selectio algorithms.
157
158
159       state STATE
160              the operation state of the port. This is primarily used by user
161              space STP/RSTP implementation. One may enter a lowercased port
162              state name, or one of the numbers below. Negative inputs are
163              ignored, and unrecognized names return an error.
164
165              0 - port is DISABLED. Make this port completely inactive.
166
167
168              1 - STP LISTENING state. Only valid if STP is enabled on the
169              bridge. In this state the port listens for STP BPDUs and drops
170              all other traffic frames.
171
172
173              2 - STP LEARNING state. Only valid if STP is enabled on the
174              bridge. In this state the port will accept traffic only for the
175              purpose of updating MAC address tables.
176
177
178              3 - STP FORWARDING state. Port is fully active.
179
180
181              4 - STP BLOCKING state. Only valid if STP is enabled on the
182              bridge. This state is used during the STP election process. In
183              this state, port will only process STP BPDUs.
184
185
186
187       guard on or guard off
188              Controls whether STP BPDUs will be processed by the bridge port.
189              By default, the flag is turned off allowed BPDU processing.
190              Turning this flag on will cause the port to stop processing STP
191              BPDUs.
192
193
194       hairpin on or hairpin off
195              Controls whether traffic may be send back out of the port on
196              which it was received. By default, this flag is turned off and
197              the bridge will not forward traffic back out of the receiving
198              port.
199
200
201       fastleave on or fastleave off
202              This flag allows the bridge to immediately stop multicast traf‐
203              fic on a port that receives IGMP Leave message. It is only used
204              with IGMP snooping is enabled on the bridge. By default the flag
205              is off.
206
207
208       root_block on or root_block off
209              Controls whether a given port is allowed to become root port or
210              not. Only used when STP is enabled on the bridge. By default the
211              flag is off.
212
213
214       learning on or learning off
215              Controls whether a given port will learn MAC addresses from
216              received traffic or not. If learning if off, the bridge will end
217              up flooding any traffic for which it has no FDB entry. By
218              default this flag is on.
219
220
221       learning_sync on or learning_sync off
222              Controls whether a given port will sync MAC addresses learned on
223              device port to bridge FDB.
224
225
226       flood on or flood off
227              Controls whether a given port will flood unicast traffic for
228              which there is no FDB entry. By default this flag is on.
229
230
231       hwmode Some network interface cards support HW bridge functionality and
232              they may be configured in different modes. Currently support
233              modes are:
234
235              vepa - Data sent between HW ports is sent on the wire to the
236              external switch.
237
238              veb - bridging happens in hardware.
239
240
241       mcast_flood on or mcast_flood off
242              Controls whether a given port will flood multicast traffic for
243              which there is no MDB entry. By default this flag is on.
244
245
246       mcast_to_unicast on or mcast_to_unicast off
247              Controls whether a given port will replicate packets using uni‐
248              cast instead of multicast. By default this flag is off.
249
250
251       neigh_suppress on or neigh_suppress off
252              Controls whether neigh discovery (arp and nd) proxy and suppres‐
253              sion is enabled on the port. By default this flag is off.
254
255
256       vlan_tunnel on or vlan_tunnel off
257              Controls whether vlan to tunnel mapping is enabled on the port.
258              By default this flag is off.
259
260
261       isolated on or isolated off
262              Controls whether a given port will be isolated, which means it
263              will be able to communicate with non-isolated ports only.  By
264              default this flag is off.
265
266
267       backup_port DEVICE
268              If the port loses carrier all traffic will be redirected to the
269              configured backup port
270
271
272       nobackup_port
273              Removes the currently configured backup port
274
275
276       self   link setting is configured on specified physical device
277
278
279       master link setting is configured on the software bridge (default)
280
281
282       -t, -timestamp
283              display current time when using monitor option.
284
285
286   bridge link show - list bridge port configuration.
287       This command displays the current bridge port configuration and flags.
288
289

bridge fdb - forwarding database management

291       fdb objects contain known Ethernet addresses on a link.
292
293
294       The corresponding commands display fdb entries, add new entries, append
295       entries, and delete old ones.
296
297
298   bridge fdb add - add a new fdb entry
299       This command creates a new fdb entry.
300
301
302       LLADDR the Ethernet MAC address.
303
304
305       dev DEV
306              the interface to which this address is associated.
307
308              local - is a local permanent fdb entry
309
310
311              static - is a static (no arp) fdb entry
312
313
314              dynamic - is a dynamic reachable age-able fdb entry
315
316
317              self - the address is associated with the port drivers fdb. Usu‐
318              ally hardware.
319
320
321              master - the address is associated with master devices fdb. Usu‐
322              ally software (default).
323
324
325              router - the destination address is associated with a router.
326              Valid if the referenced device is a VXLAN type device and has
327              route shortcircuit enabled.
328
329
330              use - the address is in use. User space can use this option to
331              indicate to the kernel that the fdb entry is in use.
332
333
334              extern_learn - this entry was learned externally. This option
335              can be used to indicate to the kernel that an entry was hardware
336              or user-space controller learnt dynamic entry. Kernel will not
337              age such an entry.
338
339
340              sticky - this entry will not change its port due to learning.
341
342
343      The next command line parameters apply only when the specified device
344      DEV is of type VXLAN.
345
346       dst IPADDR
347              the IP address of the destination VXLAN tunnel endpoint where
348              the Ethernet MAC ADDRESS resides.
349
350
351       src_vni SRC VNI
352              the src VNI Network Identifier (or VXLAN Segment ID) this entry
353              belongs to. Used only when the vxlan device is in external or
354              collect metadata mode. If omitted the value specified at vxlan
355              device creation will be used.
356
357
358       vni VNI
359              the VXLAN VNI Network Identifier (or VXLAN Segment ID) to use to
360              connect to the remote VXLAN tunnel endpoint.  If omitted the
361              value specified at vxlan device creation will be used.
362
363
364       port PORT
365              the UDP destination PORT number to use to connect to the remote
366              VXLAN tunnel endpoint.  If omitted the default value is used.
367
368
369       via DEVICE
370              device name of the outgoing interface for the VXLAN device
371              driver to reach the remote VXLAN tunnel endpoint.
372
373
374   bridge fdb append - append a forwarding database entry
375       This command adds a new fdb entry with an already known LLADDR.  Valid
376       only for multicast link layer addresses.  The command adds support for
377       broadcast and multicast Ethernet MAC addresses.  The Ethernet MAC
378       address is added multiple times into the forwarding database and the
379       vxlan device driver sends a copy of the data packet to each entry
380       found.
381
382
383       The arguments are the same as with bridge fdb add.
384
385
386   bridge fdb delete - delete a forwarding database entry
387       This command removes an existing fdb entry.
388
389
390       The arguments are the same as with bridge fdb add.
391
392
393   bridge fdb replace - replace a forwarding database entry
394       If no matching entry is found, a new one will be created instead.
395
396
397       The arguments are the same as with bridge fdb add.
398
399
400   bridge fdb show - list forwarding entries.
401       This command displays the current forwarding table.
402
403
404       With the -statistics option, the command becomes verbose. It prints out
405       the last updated and last used time for each entry.
406
407

bridge mdb - multicast group database management

409       mdb objects contain known IP multicast group addresses on a link.
410
411
412       The corresponding commands display mdb entries, add new entries, and
413       delete old ones.
414
415
416   bridge mdb add - add a new multicast group database entry
417       This command creates a new mdb entry.
418
419
420       dev DEV
421              the interface where this group address is associated.
422
423
424       port PORT
425              the port whose link is known to have members of this multicast
426              group.
427
428
429       grp GROUP
430              the IP multicast group address whose members reside on the link
431              connected to the port.
432
433              permanent - the mdb entry is permanent
434
435
436              temp - the mdb entry is temporary (default)
437
438
439
440       vid VID
441              the VLAN ID which is known to have members of this multicast
442              group.
443
444
445   bridge mdb delete - delete a multicast group database entry
446       This command removes an existing mdb entry.
447
448
449       The arguments are the same as with bridge mdb add.
450
451
452   bridge mdb show - list multicast group database entries
453       This command displays the current multicast group membership table. The
454       table is populated by IGMP and MLD snooping in the bridge driver auto‐
455       matically. It can be altered by bridge mdb add and bridge mdb del com‐
456       mands manually too.
457
458
459       dev DEV
460              the interface only whose entries should be listed. Default is to
461              list all bridge interfaces.
462
463
464       With the -details option, the command becomes verbose. It prints out
465       the ports known to have a connected router.
466
467
468       With the -statistics option, the command displays timer values for mdb
469       and router port entries.
470
471

bridge vlan - VLAN filter list

473       vlan objects contain known VLAN IDs for a link.
474
475
476       The corresponding commands display vlan filter entries, add new
477       entries, and delete old ones.
478
479
480   bridge vlan add - add a new vlan filter entry
481       This command creates a new vlan filter entry.
482
483
484       dev NAME
485              the interface with which this vlan is associated.
486
487
488       vid VID
489              the VLAN ID that identifies the vlan.
490
491
492       tunnel_info TUNNEL_ID
493              the TUNNEL ID that maps to this vlan. The tunnel id is set in
494              dst_metadata for every packet that belongs to this vlan (appli‐
495              cable to bridge ports with vlan_tunnel flag set).
496
497
498       pvid   the vlan specified is to be considered a PVID at ingress.  Any
499              untagged frames will be assigned to this VLAN.
500
501
502       untagged
503              the vlan specified is to be treated as untagged on egress.
504
505
506       self   the vlan is configured on the specified physical device.
507              Required if the device is the bridge device.
508
509
510       master the vlan is configured on the software bridge (default).
511
512
513   bridge vlan delete - delete a vlan filter entry
514       This command removes an existing vlan filter entry.
515
516
517       The arguments are the same as with bridge vlan add.  The pvid and
518       untagged flags are ignored.
519
520
521   bridge vlan show - list vlan configuration.
522       This command displays the current VLAN filter table.
523
524
525       With the -statistics option, the command displays per-vlan traffic sta‐
526       tistics.
527
528
529   bridge vlan tunnelshow - list vlan tunnel mapping.
530       This command displays the current vlan tunnel info mapping.
531
532

bridge monitor - state monitoring

534       The bridge utility can monitor the state of devices and addresses con‐
535       tinuously. This option has a slightly different format.  Namely, the
536       monitor command is the first in the command line and then the object
537       list follows:
538
539       bridge monitor [ all | OBJECT-LIST ]
540
541       OBJECT-LIST is the list of object types that we want to monitor.  It
542       may contain link, fdb, and mdb.  If no file argument is given, bridge
543       opens RTNETLINK, listens on it and dumps state changes in the format
544       described in previous sections.
545
546
547       If a file name is given, it does not listen on RTNETLINK, but opens the
548       file containing RTNETLINK messages saved in binary format and dumps
549       them.
550
551

NOTES

553       This command uses facilities added in Linux 3.0.
554
555       Although the forwarding table is maintained on a per-bridge device
556       basis the bridge device is not part of the syntax. This is a limitation
557       of the underlying netlink neighbour message protocol. When displaying
558       the forwarding table, entries for all bridges are displayed.
559       Add/delete/modify commands determine the underlying bridge device based
560       on the bridge to which the corresponding ethernet device is attached.
561
562
563

SEE ALSO

565       ip(8)
566

BUGS

568       Please direct bugreports and patches to: <netdev@vger.kernel.org>
569
570

AUTHOR

572       Original Manpage by Stephen Hemminger
573
574
575
576iproute2                         1 August 2012                       BRIDGE(8)
Impressum