Abstract: A method operates at the data link level. Each bridge associates, during a guard time, the port through which a frame is first received with a source MAC address until a unicast reply frame confirms the matching two-way path between the source and destination addresses. Any frame from the same source received through another different port is discarded. Each bridge forwards the received broadcast frames through the rest of the ports, except those involving prohibited (down-up) turns, and deviates (or optionally returns) the unicast frames with an unknown or aged destination address through the spanning tree. The protocol can operate with encapsulation in the border bridges or without encapsulation, using in this case the replacement of universal MAC addresses in the border bridges with local MAC addresses. The establishment and control of paths can optionally be performed proactively by the border bridges, especially the bridges connected to servers.