Days 5, 6: Ethernet LAN Switching

Ethernet LAN Switching
Overview
LANs (Local Area Networks)
A LAN is a network contained within a relatively small area (typically a single building or floor)
Devices within the same LAN communicate directly using Ethernet (Layer 2)
Routers are used to connect separate LANs together
Switches provide connectivity to hosts within the same LAN
 
 
Ethernet Frames
Frame Structure
An Ethernet Frame is the Layer 2 Protocol Data Unit (PDU) that carries data across a LAN.
Overall Frame Structure:
[Ethernet Header] --- [DATA / Packet] --- [Ethernet Trailer]
Ethernet Header Fields
The Ethernet header contains 5 fields totaling 14 bytes (excluding Preamble and SFD):
Field
Size
Purpose
Preamble
7 bytes
Synchronizes receiver clock (alternating 10101010 pattern)
SFD
1 byte
Start Frame Delimiter (10101011) - marks start of actual frame
Destination MAC
6 bytes
Layer 2 address of receiving device
Source MAC
6 bytes
Layer 2 address of sending device
Type/Length
2 bytes
Indicates protocol type OR data length
Note: The Preamble and SFD are typically not counted as part of the Ethernet header in frame size calculations.
Preamble (7 bytes)
Pattern: 10101010 repeated 7 times (56 bits)
Allows receiving devices to synchronize their clock with the sender
Used for timing reference
SFD (Start Frame Delimiter) (1 byte)
Value: 10101011 (8 bits)
Marks the end of the Preamble and the beginning of the actual frame data
Signals that important information follows
Destination and Source MAC Addresses (6 bytes each)
MAC = Media Access Control
Layer 2 physical address of the sending and receiving devices
Burned-in address (BIA) assigned by manufacturer
Globally unique (in theory)
Written as 12 hexadecimal characters with colons or dots: E8:BA:70:11:28:74
MAC Address Structure:
First 3 bytes (6 hex characters): OUI (Organizationally Unique Identifier)
Assigned to the manufacturer by IEEE
Identifies the company that made the device
Example: E8:BA:70 (Cisco)
Last 3 bytes (6 hex characters): Unique device identifier
Assigned by the manufacturer to individual devices
Ensures no two devices from the same manufacturer have the same MAC address
Example: 11:28:74
Type/Length Field (2 bytes)
Value of 1500 or less: Field indicates the LENGTH of the encapsulated data payload (in bytes)
Value of 1536 or greater: Field indicates the TYPE of the encapsulated protocol
Common Layer 3 Protocol Types:
Protocol
Hexadecimal
Decimal
IPv4
0x0800
2048
IPv6
0x86DD
34525
ARP
0x0806
2054
Ethernet Trailer
The Ethernet trailer contains 1 field:
FCS (Frame Check Sequence) - 4 bytes (32 bits)
Detects corrupted data using a CRC (Cyclic Redundancy Check) algorithm
Calculated over the entire received frame
If calculated CRC doesn't match FCS, the frame is discarded as corrupted
Receiver calculates CRC and compares it to the FCS value
Frame Size Calculation
Total Ethernet Header + Trailer Size:
Header: 6 + 6 + 2 = 14 bytes
Trailer (FCS): 4 bytes
Total: 18 bytes (not including Preamble + SFD, which add 8 more bytes)
Minimum Frame Size:
Minimum Ethernet frame (including header + trailer): 64 bytes total
Minimum data payload: 64 - 18 = 46 bytes
If payload < 46 bytes:
Padding bytes are added (series of 0x00 bytes) until the payload reaches 46 bytes
Ensures the frame meets the 64-byte minimum
Maximum Frame Size:
Standard Ethernet: 1518 bytes (includes header + trailer, excludes Preamble + SFD)
Payload (without header/trailer): 1500 bytes (called the MTU - Maximum Transmission Unit)
Jumbo Frames (optional): Up to 9000 bytes
 
 
MAC Addressing Deep Dive
Hexadecimal Numbering
MAC addresses are written in hexadecimal (base 16) instead of binary or decimal.
Hexadecimal:
Uses digits 0-9 and letters A-F
Each hexadecimal digit represents 4 bits
Example: E8 in hex = 11101000 in binary = 232 in decimal
MAC Address Example Breakdown:
E8:BA:70:11:28:74
└─ OUI ─┘ └─ Device ID ─┘
E8 BA 70 (Manufacturer) | 11 28 74 (Unique Device)
Dynamic vs. Static MAC Addresses
Dynamic MAC Learning (on Switches):
Switches learn MAC addresses by examining the source MAC address of frames they receive
When a frame arrives on an interface, the switch records: MAC Address | Interface | VLAN
If a frame arrives with a source MAC not in the table, the switch adds it
Dynamic entries are removed after 5 minutes of inactivity (idle timeout)
Static MAC Addresses:
Manually configured by administrators for devices that shouldn't change ports
Do not expire due to inactivity
 
 
Switch Frame Forwarding
Switches make forwarding decisions based on the destination MAC address of received frames.
Known Unicast Forwarding
When the destination MAC is in the switch's MAC address table:
Switch looks up the destination MAC address
Finds the interface associated with that MAC
Forwards the frame out only that specific interface
Frame does NOT go to other interfaces
Example:
Frame arrives on port Fa0/1, destination MAC is in table pointing to Fa0/3
Switch forwards only out Fa0/3
Unknown Unicast Flooding
When the destination MAC is NOT in the switch's MAC address table (unknown):
Switch doesn't know where to send the frame
Floods the frame to ALL interfaces except the incoming port
Ensures the destination will receive the frame even if MAC isn't learned yet
Example:
Frame arrives on Fa0/1 for an unknown destination MAC
Switch forwards out Fa0/2, Fa0/3, Fa0/4, etc. (all except Fa0/1)
One of those ports will eventually send back a reply, teaching the switch the MAC's location
Broadcast Forwarding
Broadcast frames (destination MAC = FFFF.FFFF.FFFF):
Always flooded to all interfaces except the incoming port
Used for ARP, DHCP, and other network-wide communications
MAC Address Table Maintenance Command
View the MAC address table:
Switch# show mac address-table
Output shows:
VLAN (Virtual LAN)
MAC Address
Type (DYNAMIC or STATIC)
Port/Interface
Clear the MAC address table:
Switch# clear mac address-table dynamic
Clear specific MAC entry:
Switch# clear mac address-table dynamic address E8BA.7011.2874
Clear MAC entries for a specific interface:
Switch# clear mac address-table dynamic interface FastEthernet 0/1
 
 
Interface Naming Conventions
Cisco switch interfaces follow a naming convention:
Format: [Type][Slot]/[Port]
Interface Type
Speed
Example
Fa
Fast Ethernet
100 Mbps
Gi
Gigabit Ethernet
1 Gbps
Et
10 Gigabit Ethernet
10 Gbps
Example: Fa0/1
Fa = Fast Ethernet (100 Mbps)
0 = Slot/module number
1 = Port number on that slot
 
 
Address Resolution Protocol (ARP)
What is ARP?
ARP (Address Resolution Protocol) is a protocol used to map IP addresses (Layer 3) to MAC addresses (Layer 2).
Problem it solves:
A device knows the IP address of a destination but needs the MAC address to send an Ethernet frame
ARP discovers the MAC address associated with a known IP address
Layer: Layer 2/3 (operates at the boundary)
How ARP Works
When a PC wants to send a packet to a destination with a known IP address but unknown MAC address:
PC sends an ARP REQUEST (broadcast)
Destination PC receives the broadcast
Destination responds with an ARP REPLY (unicast)
Sender learns the destination's MAC address
Sender can now send data frames
ARP Request
Sent by: Device that needs to learn a MAC address
Destination: Broadcast (FFFF.FFFF.FFFF) — sent to all devices on the LAN
Contains:
Source IP Address (sender's IP)
Destination IP Address (target's IP)
Source MAC Address (sender's MAC)
Destination MAC Address: FFFF.FFFF.FFFF (broadcast)
Message: "Who has IP address X.X.X.X? Please tell me your MAC address!"
ARP Reply
Sent by: Device that recognizes its own IP address in the ARP request
Destination: Unicast (only to the sender) — not broadcast
Contains:
Source IP Address (responder's IP)
Destination IP Address (requester's IP)
Source MAC Address (responder's MAC)
Destination MAC Address (requester's MAC)
Message: "I have IP address X.X.X.X. My MAC address is YYYY.YYYY.YYYY"
ARP Caching
ARP Table: Each device maintains an ARP table (cache) storing IP-to-MAC mappings
Devices cache ARP replies so they don't have to send another ARP request for the same IP next time
Cache entries typically expire after 240 seconds (4 minutes)
View ARP table on a device:
Device# show arp
Shows:
Protocol (usually IP)
IP Address
Age (seconds since learned)
Hardware Address (MAC)
Type (ARPA for Ethernet)
ARP Example Scenario
Scenario: PC1 wants to send data to PC2
PC1 (IP: 192.168.1.10)  → Needs MAC of PC2 (IP: 192.168.1.20)
1. PC1 sends ARP REQUEST (broadcast on Ethernet):
   "Who has 192.168.1.20? Tell 192.168.1.10"
   
2. Switch floods the ARP REQUEST to all ports (unknown destination)
3. PC2 receives ARP REQUEST, recognizes its own IP
   
4. PC2 sends ARP REPLY (unicast back to PC1):
   "I have 192.168.1.20. My MAC is AAAA.AAAA.AAAA"
   
5. Switch learns: MAC AAAA.AAAA.AAAA is on PC2's port
   Switch forwards ARP REPLY out PC1's port (known unicast)
   
6. PC1 receives ARP REPLY, learns:
   IP 192.168.1.20 = MAC AAAA.AAAA.AAAA
   
7. PC1 can now send Ethernet frames destined to AAAA.AAAA.AAAA
 
 
PING (Packet Internet Groper)
What is PING?
PING is a network utility that tests reachability to a remote host and measures round-trip time.
How it works:
Sends ICMP Echo REQUEST message to target
Target responds with ICMP Echo REPLY message
Sender measures time between request and reply
Uses:
Test if a host is reachable
Measure network latency (round-trip time)
Troubleshoot connectivity issues
PING Command
Syntax:
Device# ping [IP_address]
Example:
Router# ping 192.168.1.20
PING Output
By default, Cisco IOS sends 5 ICMP requests/replies (100 bytes each)
Router# ping 192.168.1.20
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echoes to 192.168.1.20, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/5 ms
Output Legend:
Symbol
Meaning
!
Successful echo reply received
.
Echo request timed out (no reply)
U
Destination unreachable
C
Congestion experienced
I
User interrupted
Statistics shown:
Number of successful replies
Success rate (percentage)
Round-trip times: min/avg/max (in milliseconds)
ICMP Messages
PING uses ICMP (Internet Control Message Protocol) which operates at Layer 3
Two ICMP message types for ping:
Echo Request (Type 8) — Sent by host asking for a reply
Echo Reply (Type 0) — Response from target confirming it's reachable
Other ICMP message types (used for troubleshooting):
Destination Unreachable (Type 3) — Host/network unreachable
Time Exceeded (Type 11) — TTL expired (used by traceroute)
Redirect (Type 5) — Better route available
 
 
Troubleshooting Commands Reference
View ARP Table
Device# show arp
Output shows:
Protocol type (usually IP)
IP address
Hardware address (MAC address in HHHHH.HHHHH.HHHHHH format)
Type (ARPA for Ethernet)
Age in minutes (how long since learned)
Example:
Device# show arp
Protocol  Address          Age (min)  Hardware Addr   Type
Internet  192.168.1.10        0      AAAA.BBBB.CCCC  ARPA
Internet  192.168.1.20        2      DDDD.EEEE.FFFF  ARPA
View Switch MAC Address Table
Switch# show mac address-table
Output shows:
VLAN number
MAC address (HHHH.HHHH.HHHH format)
Type (DYNAMIC or STATIC)
Ports (interface where MAC is learned)
Example:
Switch# show mac address-table
Vlan    Mac Address       Type        Ports
----    -----------       ----        -----
 1      AAAA.BBBB.CCCC    DYNAMIC     Fa0/1
 1      DDDD.EEEE.FFFF    DYNAMIC     Fa0/2
 1      ffff.ffff.ffff    STATIC      CPU
Clear MAC Address Table
Switch# clear mac address-table dynamic
Clears all dynamic MAC entries (not static ones)
Useful when troubleshooting or deploying a new device
Clear specific MAC address:
Switch# clear mac address-table dynamic address AAAA.BBBB.CCCC
Clear MAC entries on a specific interface:
Switch# clear mac address-table dynamic interface FastEthernet 0/1
 
 
Summary: Frame Forwarding Decision Tree
Switch receives frame on interface X
Does frame have a broadcast destination (FFFF.FFFF.FFFF)?
├─ YES → FLOOD to all interfaces except X
└─ NO  → Is destination MAC in MAC address table?
         ├─ YES (KNOWN UNICAST) → Forward to specific interface
         └─ NO  (UNKNOWN UNICAST) → FLOOD to all interfaces except X
 
 
Quick Reference Table
Concept
Size
Purpose
MAC Address
6 bytes (48 bits)
Layer 2 physical address
Ethernet Header
14 bytes
Destination MAC, Source MAC, Type/Length
Ethernet Trailer (FCS)
4 bytes
Error detection via CRC
Minimum Frame
64 bytes
Ensures collision detection reliability
Maximum Frame
1518 bytes
Standard Ethernet MTU is 1500 bytes
Preamble + SFD
8 bytes
Not counted in frame size; for synchronization
 
 
Key Takeaways for CCNA
✅ MAC addresses are Layer 2 addresses; switches use them for forwarding
✅ Ethernet frames have header, data payload, and trailer with error detection
✅ Switches learn source MAC addresses from incoming frames and build a MAC address table
✅ Flooding vs. Forwarding: If destination MAC is known, forward to specific port; if unknown, flood to all except incoming
✅ ARP maps IP addresses to MAC addresses—used when sending data to a known IP but unknown MAC
✅ PING uses ICMP to test reachability and measure latency
✅ Frame sizing: Minimum 64 bytes, maximum 1518 bytes (standard), padding added if needed
✅ Hexadecimal used to represent MAC and FCS values in network notation
✅ Dynamic MAC entries are learned and age out after 5 minutes of inactivity; static entries are permanent
✅ Commands: show mac address-table, show arp, ping, clear mac address-table dynamic