Days 5, 6: Ethernet LAN Switching

Ethernet LAN Switching

Overview

LANs (Local Area Networks)

• A LAN is a network contained within a relatively small area (typically a single building or floor)

• Devices within the same LAN communicate directly using Ethernet (Layer 2)

• Routers are used to connect separate LANs together

• Switches provide connectivity to hosts within the same LAN

 

---

 

Ethernet Frames

Frame Structure

An Ethernet Frame is the Layer 2 Protocol Data Unit (PDU) that carries data across a LAN.

Overall Frame Structure:

[Ethernet Header] --- [DATA / Packet] --- [Ethernet Trailer]

Ethernet Header Fields

The Ethernet header contains 5 fields totaling 14 bytes (excluding Preamble and SFD):

Note: The Preamble and SFD are typically not counted as part of the Ethernet header in frame size calculations.

Preamble (7 bytes)

• Pattern: 10101010 repeated 7 times (56 bits)

• Allows receiving devices to synchronize their clock with the sender

• Used for timing reference

SFD (Start Frame Delimiter) (1 byte)

• Value: 10101011 (8 bits)

• Marks the end of the Preamble and the beginning of the actual frame data

• Signals that important information follows

Destination and Source MAC Addresses (6 bytes each)

• MAC = Media Access Control

• Layer 2 physical address of the sending and receiving devices

• Burned-in address (BIA) assigned by manufacturer

• Globally unique (in theory)

• Written as 12 hexadecimal characters with colons or dots: E8:BA:70:11:28:74

MAC Address Structure:

• First 3 bytes (6 hex characters): OUI (Organizationally Unique Identifier)
  
  

  • Assigned to the manufacturer by IEEE

  • Identifies the company that made the device

  • Example: E8:BA:70 (Cisco)

• Last 3 bytes (6 hex characters): Unique device identifier
  
  

  • Assigned by the manufacturer to individual devices

  • Ensures no two devices from the same manufacturer have the same MAC address

  • Example: 11:28:74

Type/Length Field (2 bytes)

• Value of 1500 or less: Field indicates the LENGTH of the encapsulated data payload (in bytes)

• Value of 1536 or greater: Field indicates the TYPE of the encapsulated protocol

Common Layer 3 Protocol Types:

Ethernet Trailer

The Ethernet trailer contains 1 field:

FCS (Frame Check Sequence) - 4 bytes (32 bits)

• Detects corrupted data using a CRC (Cyclic Redundancy Check) algorithm

• Calculated over the entire received frame

• If calculated CRC doesn't match FCS, the frame is discarded as corrupted

• Receiver calculates CRC and compares it to the FCS value

Frame Size Calculation

Total Ethernet Header + Trailer Size:

• Header: 6 + 6 + 2 = 14 bytes

• Trailer (FCS): 4 bytes

• Total: 18 bytes (not including Preamble + SFD, which add 8 more bytes)

Minimum Frame Size:

• Minimum Ethernet frame (including header + trailer): 64 bytes total

• Minimum data payload: 64 - 18 = 46 bytes

If payload < 46 bytes:

• Padding bytes are added (series of 0x00 bytes) until the payload reaches 46 bytes

• Ensures the frame meets the 64-byte minimum

Maximum Frame Size:

• Standard Ethernet: 1518 bytes (includes header + trailer, excludes Preamble + SFD)

• Payload (without header/trailer): 1500 bytes (called the MTU - Maximum Transmission Unit)

• Jumbo Frames (optional): Up to 9000 bytes

 

---

 

MAC Addressing Deep Dive

Hexadecimal Numbering

MAC addresses are written in hexadecimal (base 16) instead of binary or decimal.

Hexadecimal:

• Uses digits 0-9 and letters A-F

• Each hexadecimal digit represents 4 bits

• Example: E8 in hex = 11101000 in binary = 232 in decimal

MAC Address Example Breakdown:

E8:BA:70:11:28:74

└─ OUI ─┘ └─ Device ID ─┘

E8 BA 70 (Manufacturer) | 11 28 74 (Unique Device)

Dynamic vs. Static MAC Addresses

Dynamic MAC Learning (on Switches):

• Switches learn MAC addresses by examining the source MAC address of frames they receive

• When a frame arrives on an interface, the switch records: MAC Address | Interface | VLAN

• If a frame arrives with a source MAC not in the table, the switch adds it

• Dynamic entries are removed after 5 minutes of inactivity (idle timeout)

Static MAC Addresses:

• Manually configured by administrators for devices that shouldn't change ports

• Do not expire due to inactivity

 

---

 

Switch Frame Forwarding

Switches make forwarding decisions based on the destination MAC address of received frames.

Known Unicast Forwarding

When the destination MAC is in the switch's MAC address table:

1. Switch looks up the destination MAC address

2. Finds the interface associated with that MAC

3. Forwards the frame out only that specific interface

4. Frame does NOT go to other interfaces

Example:

• Frame arrives on port Fa0/1, destination MAC is in table pointing to Fa0/3

• Switch forwards only out Fa0/3

Unknown Unicast Flooding

When the destination MAC is NOT in the switch's MAC address table (unknown):

1. Switch doesn't know where to send the frame

2. Floods the frame to ALL interfaces except the incoming port

3. Ensures the destination will receive the frame even if MAC isn't learned yet

Example:

• Frame arrives on Fa0/1 for an unknown destination MAC

• Switch forwards out Fa0/2, Fa0/3, Fa0/4, etc. (all except Fa0/1)

• One of those ports will eventually send back a reply, teaching the switch the MAC's location

Broadcast Forwarding

Broadcast frames (destination MAC = FFFF.FFFF.FFFF):

• Always flooded to all interfaces except the incoming port

• Used for ARP, DHCP, and other network-wide communications

MAC Address Table Maintenance Command

View the MAC address table:

Switch# show mac address-table

Output shows:

• VLAN (Virtual LAN)

• MAC Address

• Type (DYNAMIC or STATIC)

• Port/Interface

Clear the MAC address table:

Switch# clear mac address-table dynamic

Clear specific MAC entry:

Switch# clear mac address-table dynamic address E8BA.7011.2874

Clear MAC entries for a specific interface:

Switch# clear mac address-table dynamic interface FastEthernet 0/1

 

---

 

Interface Naming Conventions

Cisco switch interfaces follow a naming convention:

Format: [Type][Slot]/[Port]

Example: Fa0/1

• Fa = Fast Ethernet (100 Mbps)

• 0 = Slot/module number

• 1 = Port number on that slot

 

---

 

Address Resolution Protocol (ARP)

What is ARP?

ARP (Address Resolution Protocol) is a protocol used to map IP addresses (Layer 3) to MAC addresses (Layer 2).

Problem it solves:

• A device knows the IP address of a destination but needs the MAC address to send an Ethernet frame

• ARP discovers the MAC address associated with a known IP address

Layer: Layer 2/3 (operates at the boundary)

How ARP Works

When a PC wants to send a packet to a destination with a known IP address but unknown MAC address:

1. PC sends an ARP REQUEST (broadcast)

2. Destination PC receives the broadcast

3. Destination responds with an ARP REPLY (unicast)

4. Sender learns the destination's MAC address

5. Sender can now send data frames

ARP Request

Sent by: Device that needs to learn a MAC address

Destination: Broadcast (FFFF.FFFF.FFFF) — sent to all devices on the LAN

Contains:

• Source IP Address (sender's IP)

• Destination IP Address (target's IP)

• Source MAC Address (sender's MAC)

• Destination MAC Address: FFFF.FFFF.FFFF (broadcast)

Message: "Who has IP address X.X.X.X? Please tell me your MAC address!"

ARP Reply

Sent by: Device that recognizes its own IP address in the ARP request

Destination: Unicast (only to the sender) — not broadcast

Contains:

• Source IP Address (responder's IP)

• Destination IP Address (requester's IP)

• Source MAC Address (responder's MAC)

• Destination MAC Address (requester's MAC)

Message: "I have IP address X.X.X.X. My MAC address is YYYY.YYYY.YYYY"

ARP Caching

ARP Table: Each device maintains an ARP table (cache) storing IP-to-MAC mappings

• Devices cache ARP replies so they don't have to send another ARP request for the same IP next time

• Cache entries typically expire after 240 seconds (4 minutes)

View ARP table on a device:

Device# show arp

Shows:

• Protocol (usually IP)

• IP Address

• Age (seconds since learned)

• Hardware Address (MAC)

• Type (ARPA for Ethernet)

ARP Example Scenario

Scenario: PC1 wants to send data to PC2

PC1 (IP: 192.168.1.10)  → Needs MAC of PC2 (IP: 192.168.1.20)

1. PC1 sends ARP REQUEST (broadcast on Ethernet):

   "Who has 192.168.1.20? Tell 192.168.1.10"

   

2. Switch floods the ARP REQUEST to all ports (unknown destination)

3. PC2 receives ARP REQUEST, recognizes its own IP

   

4. PC2 sends ARP REPLY (unicast back to PC1):

   "I have 192.168.1.20. My MAC is AAAA.AAAA.AAAA"

   

5. Switch learns: MAC AAAA.AAAA.AAAA is on PC2's port

   Switch forwards ARP REPLY out PC1's port (known unicast)

   

6. PC1 receives ARP REPLY, learns:

   IP 192.168.1.20 = MAC AAAA.AAAA.AAAA

   

7. PC1 can now send Ethernet frames destined to AAAA.AAAA.AAAA

 

---

 

PING (Packet Internet Groper)

What is PING?

PING is a network utility that tests reachability to a remote host and measures round-trip time.

How it works:

1. Sends ICMP Echo REQUEST message to target

2. Target responds with ICMP Echo REPLY message

3. Sender measures time between request and reply

Uses:

• Test if a host is reachable

• Measure network latency (round-trip time)

• Troubleshoot connectivity issues

PING Command

Syntax:

Device# ping [IP_address]

Example:

Router# ping 192.168.1.20

PING Output

By default, Cisco IOS sends 5 ICMP requests/replies (100 bytes each)

Router# ping 192.168.1.20

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echoes to 192.168.1.20, timeout is 2 seconds:

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/5 ms

Output Legend:

Statistics shown:

• Number of successful replies

• Success rate (percentage)

• Round-trip times: min/avg/max (in milliseconds)

ICMP Messages

PING uses ICMP (Internet Control Message Protocol) which operates at Layer 3

Two ICMP message types for ping:

1. Echo Request (Type 8) — Sent by host asking for a reply

2. Echo Reply (Type 0) — Response from target confirming it's reachable

Other ICMP message types (used for troubleshooting):

• Destination Unreachable (Type 3) — Host/network unreachable

• Time Exceeded (Type 11) — TTL expired (used by traceroute)

• Redirect (Type 5) — Better route available

 

---

 

Troubleshooting Commands Reference

View ARP Table

Device# show arp

Output shows:

• Protocol type (usually IP)

• IP address

• Hardware address (MAC address in HHHHH.HHHHH.HHHHHH format)

• Type (ARPA for Ethernet)

• Age in minutes (how long since learned)

Example:

Device# show arp

Protocol  Address          Age (min)  Hardware Addr   Type

Internet  192.168.1.10        0      AAAA.BBBB.CCCC  ARPA

Internet  192.168.1.20        2      DDDD.EEEE.FFFF  ARPA

View Switch MAC Address Table

Switch# show mac address-table

Output shows:

• VLAN number

• MAC address (HHHH.HHHH.HHHH format)

• Type (DYNAMIC or STATIC)

• Ports (interface where MAC is learned)

Example:

Switch# show mac address-table

Vlan    Mac Address       Type        Ports

----    -----------       ----        -----

 1      AAAA.BBBB.CCCC    DYNAMIC     Fa0/1

 1      DDDD.EEEE.FFFF    DYNAMIC     Fa0/2

 1      ffff.ffff.ffff    STATIC      CPU

Clear MAC Address Table

Switch# clear mac address-table dynamic

• Clears all dynamic MAC entries (not static ones)

• Useful when troubleshooting or deploying a new device

Clear specific MAC address:

Switch# clear mac address-table dynamic address AAAA.BBBB.CCCC

Clear MAC entries on a specific interface:

Switch# clear mac address-table dynamic interface FastEthernet 0/1

 

---

 

Summary: Frame Forwarding Decision Tree

Switch receives frame on interface X

Does frame have a broadcast destination (FFFF.FFFF.FFFF)?

├─ YES → FLOOD to all interfaces except X

└─ NO  → Is destination MAC in MAC address table?

         ├─ YES (KNOWN UNICAST) → Forward to specific interface

         └─ NO  (UNKNOWN UNICAST) → FLOOD to all interfaces except X

 

---

 

Quick Reference Table

 

---

 

Key Takeaways for CCNA

✅ MAC addresses are Layer 2 addresses; switches use them for forwarding

✅ Ethernet frames have header, data payload, and trailer with error detection

✅ Switches learn source MAC addresses from incoming frames and build a MAC address table

✅ Flooding vs. Forwarding: If destination MAC is known, forward to specific port; if unknown, flood to all except incoming

✅ ARP maps IP addresses to MAC addresses—used when sending data to a known IP but unknown MAC

✅ PING uses ICMP to test reachability and measure latency

✅ Frame sizing: Minimum 64 bytes, maximum 1518 bytes (standard), padding added if needed

✅ Hexadecimal used to represent MAC and FCS values in network notation

✅ Dynamic MAC entries are learned and age out after 5 minutes of inactivity; static entries are permanent

✅ Commands: show mac address-table, show arp, ping, clear mac address-table dynamic