In every sample of configuring wireless access points, including Cisco documentation (notably the older Aeronet ones), I find the following lines to be configured on the bridge group which includes the radio interface:
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
Yet I can find no explanation anywhere why they are always there, and what do these actually do?
block-unknown-source - the only Cisco doc I find is a configuration sample which states "blocks traffic that comes from unknown MAC address sources". Understandable enough - but none of the samples contain any configuration to specify allowed MAC addresses (including actual live APs, and they work totally fine). I know some APs can be configured to use MAC address authentication, yet on APs not so configured the above line is still present.
no source-learning - same Cisco doc merely states "disables source learning". Great. Learning what? From who? Does it mean automatic MAC-address learning? Would fit to block-unknown-source so that the AP will not learn the MAC of an attacker, but again, where are the allowed MAC addresses? Or is that something totally unrelated to MAC addresses?
no unicast-flooding - I understand the concept, every switch does unicast flooding, but why would we not want this on an AP?
spanning-disabled: this of course disables STP. Yet I do not quite understand how STP even comes into the picture on a wireless AP - typically it has one wired ethernet port and one or more radio antennas. STP would ensure no multiple links between devices exists. How does this apply to wireless APs?
