# Days 5, 6: Ethernet LAN Switching

# CCNA 200-301 Study Guide: Ethernet Switching and ARP

## 1.0 Ethernet's Role in the LAN: Layer 2 Fundamentals

Ethernet is the foundational technology for modern Local Area Networks (LANs). It defines how devices connect and communicate within a local environment across Layers 1 and 2 of the OSI model.

### Layers of Operation

- Layer 1 (Physical): Defines cabling (Fiber, UTP), connectors (RJ-45), and electrical/optical signaling.
- Layer 2 (Data Link): Establishes media access rules and physical addressing via MAC addresses.

### The Function of a Network Switch

Switches are Layer 2 devices that make intelligent forwarding decisions, creating a more efficient network than legacy hubs.

<div align="left" dir="ltr" id="bkmrk-concept-definition-s"><table><colgroup><col width="113"></col><col width="231"></col><col width="258"></col></colgroup><tbody><tr><td>Concept

</td><td>Definition

</td><td>Switch Impact

</td></tr><tr><td>Collision Domain

</td><td>A network section where packets can collide if sent simultaneously.

</td><td>Each switch port is a separate collision domain. In full-duplex, collisions are eliminated.

</td></tr><tr><td>Broadcast Domain

</td><td>The area where a broadcast frame (sent to all) is propagated.

</td><td>Switches forward broadcasts out all ports. Only routers (Layer 3) segment broadcast domains.

</td></tr></tbody></table>

</div>### Duplex Communication Modes

1. Half-Duplex: One-way communication at a time. Uses CSMA/CD to manage collisions. (Legacy/Hubs).
2. Full-Duplex: Simultaneous two-way communication. Standard in modern switching; eliminates collisions.

## 2.0 Anatomy of an Ethernet Frame

The Ethernet frame is the Layer 2 Protocol Data Unit (PDU). The standard Ethernet II frame structure is detailed below:

<div align="left" dir="ltr" id="bkmrk-field-size-descripti"><table><colgroup><col width="129"></col><col width="86"></col><col width="387"></col></colgroup><tbody><tr><td>Field

</td><td>Size

</td><td>Description

</td></tr><tr><td>Preamble

</td><td>7 Bytes

</td><td>Alternating 1s and 0s for clock synchronization.

</td></tr><tr><td>SFD

</td><td>1 Byte

</td><td>Start Frame Delimiter; signals the start of the Destination MAC.

</td></tr><tr><td>Destination MAC

</td><td>6 Bytes

</td><td>Address of the recipient. FFFF.FFFF.FFFF indicates a broadcast.

</td></tr><tr><td>Source MAC

</td><td>6 Bytes

</td><td>Address of the sender. Used by switches to learn device locations.

</td></tr><tr><td>Type / Length

</td><td>2 Bytes

</td><td>Value $\\ge 1536$ = Type (e.g., 0x0800 for IPv4). Value $\\le 1500$ = Length.

</td></tr><tr><td>Data (Payload)

</td><td>46–1500 B

</td><td>Encapsulated Layer 3 packet. Padding added if $&lt; 46$ bytes.

</td></tr><tr><td>FCS

</td><td>4 Bytes

</td><td>Frame Check Sequence; uses CRC to detect transmission errors.

</td></tr></tbody></table>

</div>## 3.0 Understanding MAC Addressing

A Media Access Control (MAC) address is a 48-bit (6-byte) unique physical identifier "burned into" the NIC.

- Format: 12 Hexadecimal characters (e.g., 000C.29B0.119D).

### MAC Address Structure

1. OUI (Organizationally Unique Identifier): The first 3 bytes. Assigned by the IEEE to manufacturers (e.g., Cisco, Intel).
2. NIC Specific: The last 3 bytes. A unique serial number assigned by the manufacturer.

## 4.0 The Core Logic of an Ethernet Switch

Switches use a MAC Address Table (also known as the CAM Table) to map MAC addresses to physical ports.

### A. The Learning Process

1. Switch receives a frame.
2. Inspects the Source MAC.
3. Records the MAC and the incoming port in the table.
4. Aging: Entries are removed after 300 seconds (default) if no new traffic is seen from that MAC.

### B. The Forwarding Process

Decision based on the Destination MAC:

<div align="left" dir="ltr" id="bkmrk-destination-type-con"><table><colgroup><col width="138"></col><col width="199"></col><col width="265"></col></colgroup><tbody><tr><td>Destination Type

</td><td>Condition

</td><td>Action

</td></tr><tr><td>Known Unicast

</td><td>MAC is in the table.

</td><td>Forward out the specific port only.

</td></tr><tr><td>Unknown Unicast

</td><td>MAC is NOT in the table.

</td><td>Flood: Send out all ports except the source.

</td></tr><tr><td>Broadcast

</td><td>MAC is FFFF.FFFF.FFFF.

</td><td>Flood: Send out all ports except the source.

</td></tr><tr><td>Multicast

</td><td>MAC starts with 0100.5E.

</td><td>Flood (unless IGMP Snooping is active).

</td></tr></tbody></table>

</div>### C. Internal Switching Methods

- Store-and-Forward: Receives entire frame, checks CRC (error check), then forwards. Most reliable.
- Cut-Through: Forwards as soon as the Destination MAC is read. Fastest, but forwards errors.
- Fragment-Free: Buffers the first 64 bytes (where most collisions occur) before forwarding.

## 5.0 Bridging the Gap: Address Resolution Protocol (ARP)

ARP resolves a known Layer 3 IP address to an unknown Layer 2 MAC address.

1. ARP Request: A broadcast (FFFF.FFFF.FFFF) asking "Who has IP X.X.X.X?"
2. ARP Reply: A unicast response from the target device providing its MAC address.
3. ARP Cache: Devices store these mappings locally to avoid repeated broadcasts.
- Cisco Check: show arp
- Windows Check: arp -a


## 6.0 Practical Verification (Cisco IOS)

### MAC Table Commands

- show mac address-table: Displays the CAM table.
- clear mac address-table dynamic: Flushes all learned entries.
- clear mac address-table dynamic interface \[ID\]: Flushes entries for a specific port.

### Ping Output Symbols

- !: Success (ICMP Echo Reply received).
- .: Timeout (Commonly seen on the first ping due to ARP resolution delay).
- U: Unreachable (Routing error; no path to the destination).

## 7.0 Synthesis: The Operational Loop

1. Host A wants to talk to Host B (IP known, MAC unknown).
2. Host A sends an ARP Request (Broadcast).
3. Switch learns Host A's MAC and floods the ARP Request.
4. Host B sends an ARP Reply (Unicast).
5. Switch learns Host B's MAC and forwards the reply to Host A.
6. Host A encapsulates the data in a frame and sends it; the Switch performs Known Unicast forwarding.