In this lesson, you will learn how the Linux Bridge acts as a virtual Layer 2 switch to interconnect isolated network namespaces and how it facilitates ARP resolution between them.
The Bridge as a Virtual Switch
When you connect two veth pairs to a Linux bridge (br0), you effectively create a virtual local area network (LAN) inside your host. One end of each veth pair resides in a container’s network namespace, while the other end acts as a port on the bridge. When a container sends an Ethernet frame, the bridge receives it and performs a MAC address lookup on its Forwarding Database (FDB). If the destination MAC is known, the bridge forwards the frame to the specific port connected to that container.
The Challenge of ARP Resolution
Because containers are isolated, they do not inherently know the MAC address associated with an IP address on the same virtual segment. This is where Address Resolution Protocol (ARP) becomes critical.
When Container A wants to talk to Container B, it broadcasts an ARP request: "Who has 192.168.1.5? Tell 192.168.1.2."
- Broadcast Propagation: The bridge receives this broadcast frame on its ingress port. Because it is a L2 switch, it floods this request to every other port on the bridge, except the one it arrived on.
- Namespace Traversal: The frame travels through the
vethpair and enters Container B’s network namespace. - Response: Container B processes the ARP request and generates an ARP reply containing its MAC address.
- Learning: As the reply travels back through the bridge, the bridge inspects the source MAC address of the frame and updates its FDB. Now, the bridge "knows" that the MAC address of Container B is located behind the specific port it just received the reply from.
By bridging these interfaces, the kernel automates the discovery process, allowing containers to communicate seamlessly without knowing the host's underlying physical networking topology.
# Create the bridge and add a veth pair to it
ip link add name br0 type bridge
ip link set br0 up
ip link set veth-container-a master br0
Key Takeaway: The Linux Bridge functions as a learning switch that populates its Forwarding Database through ARP traffic, allowing isolated network namespaces to resolve L2 addresses and exchange traffic locally.