Abstract: This document describes tools that withhold a data packet from a switch port despite its destination address. In one embodiment, the tools may receive a port description identifying a set of switch ports. The tools configure the set of ports so that data packets exchanged through the switch by interested entities that would otherwise be forwarded to uninterested entities are instead withheld from the uninterested entities. In another embodiment, the tools may configure a data-packet switch according to a port description identifying a set of ports and a subset of the set of ports. The tools receive a data packet that includes a broadcast destination address on a receive port and then determine, based on the port description, whether the receive port belongs to the subset. If the receive port does not belong to the subset the data packet is withheld from the other ports of the set.

Abstract: This document describes tools that forward data packets to trusted ports and prevent data packets from egressing non-trusted ports. To do so, the tools receive a data packet having a destination address specifying that the data packet be forwarded to a set of ports associated with a domain. The tools identify a subset of the set of ports as trusted ports and forward the data packet to the subset. The tools prevent the data packet from egressing non-trusted ports of the set. In one embodiment, the tools may classify a port as trusted. To do so, the tools receive a configuration communication identifying trusted devices. The tools broadcast a request to the trusted devices and receive a reply from a reply device on a reply port. The tools determine that the reply device is one of the trusted devices and mark the reply port as a trusted port.