Days 5, 6: Ethernet LAN Switching

CCNA 200-301 Study Guide: Ethernet LAN Switching and ARP

1.0 Ethernet's Role in the LAN: Layer 2 FundamentalsOverview

EthernetLANs is the foundational technology for modern (Local Area Networks (LANs). It defines how devices connect and communicate within a local environment across Layers 1 and 2 of the OSI model.Networks)

Layers of Operation

• LayerA 1LAN is a network contained within a relatively small area (Physical):typically Definesa cablingsingle (Fiber,building UTP),or connectors (RJ-45), and electrical/optical signaling.floor)

• LayerDevices 2within (Datathe Link):same EstablishesLAN mediacommunicate accessdirectly rulesusing and physical addressing via MAC addresses.

The Function of a Network Switch

Switches are Layer 2 devices that make intelligent forwarding decisions, creating a more efficient network than legacy hubs.

Duplex Communication Modes

Half-Duplex: One-way communication at a time. Uses CSMA/CD to manage collisions. (Legacy/Hubs).2)

Full-Duplex:Routers Simultaneousare two-wayused communication.to Standardconnect inseparate modernLANs switching; eliminates collisions.together

Switches provide connectivity to hosts within the same LAN

 

---

 

2.0Ethernet AnatomyFrames

of

Frame anStructure

An Ethernet Frame

The Ethernet frame is the Layer 2 Protocol Data Unit (PDU). that carries data across a LAN.

Overall Frame Structure:

[Ethernet Header] --- [DATA / Packet] --- [Ethernet Trailer]

Ethernet Header Fields

The standard Ethernet IIheader framecontains structure5 isfields detailedtotaling below:14 bytes (excluding Preamble and SFD):

3.0

Note: UnderstandingThe Preamble and SFD are typically not counted as part of the Ethernet header in frame size calculations.

Preamble (7 bytes)

Pattern: 10101010 repeated 7 times (56 bits)

Allows receiving devices to synchronize their clock with the sender

Used for timing reference

SFD (Start Frame Delimiter) (1 byte)

Value: 10101011 (8 bits)

Marks the end of the Preamble and the beginning of the actual frame data

Signals that important information follows

Destination and Source MAC AddressingAddresses (6 bytes each)

AMAC = Media Access Control

(MAC)

Layer 2 physical address isof athe 48-bitsending and receiving devices

Burned-in address (6-byte)BIA) assigned by manufacturer

Globally unique physical(in identifiertheory)

"burned into" the

Written NIC.as 12 hexadecimal characters with colons or dots: E8:BA:70:11:28:74

MAC Address Structure:

• Format:First 123 Hexadecimal charactersbytes (e.g.,6 000C.29B0.119D).

  hex

characters):

MAC Address Structure

OUI (Organizationally Unique Identifier):

The first

3 bytes.

Assigned Assignedto the manufacturer by the IEEE to manufacturers (e.g., Cisco, Intel).

NIC Specific: The last 3 bytes. A unique serial number assigned byIdentifies the manufacturer.

company that

4.0 The Core Logic of an Ethernet Switch

Switches use a MAC Address Table (also known asmade the CAM Table) to map MAC addresses to physical ports.

A. The Learning Process

Switch receives a frame.device

InspectsExample: E8:BA:70 (Cisco)

Last 3 bytes (6 hex characters): Unique device identifier

Assigned by the Sourcemanufacturer MAC.to individual devices

RecordsEnsures no two devices from the MACsame andmanufacturer have the incomingsame portMAC in the table.address

Aging:Example: Entries are removed after 300 seconds (default) if no new traffic is seen from that MAC.11:28:74

B. The

Type/Length ForwardingField Process

(2 bytes)

DecisionValue basedof on1500 or less: Field indicates the DestinationLENGTH MAC:of the encapsulated data payload (in bytes)

Value of 1536 or greater: Field indicates the TYPE of the encapsulated protocol

Common Layer 3 Protocol Types:

C.Ethernet InternalTrailer

Switching

The MethodsEthernet trailer contains 1 field:

FCS (Frame Check Sequence) - 4 bytes (32 bits)

• Store-and-Forward:Detects Receivescorrupted entiredata frame,using checksa CRC (errorCyclic check),Redundancy thenCheck) forwards. Most reliable.algorithm

• Cut-Through:Calculated Forwards as soon asover the Destinationentire MACreceived is read. Fastest, but forwards errors.frame

• Fragment-Free:If Bufferscalculated CRC doesn't match FCS, the firstframe 64is bytesdiscarded (whereas mostcorrupted

  collisions

occur) before

Receiver forwarding.calculates CRC and compares it to the FCS value

5.0

Frame BridgingSize Calculation

Total Ethernet Header + Trailer Size:

Header: 6 + 6 + 2 = 14 bytes

Trailer (FCS): 4 bytes

Total: 18 bytes (not including Preamble + SFD, which add 8 more bytes)

Minimum Frame Size:

Minimum Ethernet frame (including header + trailer): 64 bytes total

Minimum data payload: 64 - 18 = 46 bytes

If payload < 46 bytes:

Padding bytes are added (series of 0x00 bytes) until the Gap:payload reaches 46 bytes

Ensures the frame meets the 64-byte minimum

Maximum Frame Size:

Standard Ethernet: 1518 bytes (includes header + trailer, excludes Preamble + SFD)

Payload (without header/trailer): 1500 bytes (called the MTU - Maximum Transmission Unit)

Jumbo Frames (optional): Up to 9000 bytes

 

---

 

MAC Addressing Deep Dive

Hexadecimal Numbering

MAC addresses are written in hexadecimal (base 16) instead of binary or decimal.

Hexadecimal:

Uses digits 0-9 and letters A-F

Each hexadecimal digit represents 4 bits

Example: E8 in hex = 11101000 in binary = 232 in decimal

MAC Address ResolutionExample ProtocolBreakdown:

E8:BA:70:11:28:74

└─ OUI ─┘ └─ Device ID ─┘

E8 BA 70 (ARP)Manufacturer) | 11 28 74 (Unique Device)

Dynamic vs. Static MAC Addresses

Dynamic MAC Learning (on Switches):

Switches learn MAC addresses by examining the source MAC address of frames they receive

When a frame arrives on an interface, the switch records: MAC Address | Interface | VLAN

If a frame arrives with a source MAC not in the table, the switch adds it

Dynamic entries are removed after 5 minutes of inactivity (idle timeout)

Static MAC Addresses:

Manually configured by administrators for devices that shouldn't change ports

Do not expire due to inactivity

 

---

 

Switch Frame Forwarding

ARPSwitches resolvesmake aforwarding knowndecisions Layerbased 3on IPthe destination MAC address toof anreceived unknownframes.

Layer

Known 2Unicast Forwarding

When the destination MAC address.is in the switch's MAC address table:

1. ARPSwitch Request:looks Aup broadcastthe (FFFF.FFFF.FFFF)destination askingMAC "Who has IP X.X.X.X?"address

2. ARP Reply: A unicast response fromFinds the targetinterface deviceassociated providingwith itsthat MAC address.

3. ARPForwards Cache:the Devicesframe storeout theseonly mappingsthat locallyspecific to avoid repeated broadcasts.

Cisco Check: show arpinterface

WindowsFrame Check:does arpNOT -ago to other interfaces

6.0 Practical Verification (Cisco IOS)

MAC Table Commands

Example:

• showFrame macarrives address-table:on Displaysport theFa0/1, CAMdestination table.MAC is in table pointing to Fa0/3

• Switch forwards only out Fa0/3

Unknown Unicast Flooding

When the destination MAC is NOT in the switch's MAC address table (unknown):

Switch doesn't know where to send the frame

Floods the frame to ALL interfaces except the incoming port

Ensures the destination will receive the frame even if MAC isn't learned yet

Example:

Frame arrives on Fa0/1 for an unknown destination MAC

Switch forwards out Fa0/2, Fa0/3, Fa0/4, etc. (all except Fa0/1)

One of those ports will eventually send back a reply, teaching the switch the MAC's location

Broadcast Forwarding

Broadcast frames (destination MAC = FFFF.FFFF.FFFF):

Always flooded to all interfaces except the incoming port

Used for ARP, DHCP, and other network-wide communications

MAC Address Table Maintenance Command

View the MAC address table:

Switch# show mac address-table

Output shows:

VLAN (Virtual LAN)

MAC Address

Type (DYNAMIC or STATIC)

Port/Interface

Clear the MAC address table:

Switch# clear mac address-table dynamic: Flushes all learned entries.dynamic

Clear specific MAC entry:

Switch# clear mac address-table dynamic address E8BA.7011.2874

Clear MAC entries for a specific interface:

Switch# clear mac address-table dynamic interface FastEthernet 0/1

 

---

 

Interface Naming Conventions

Cisco switch interfaces follow a naming convention:

Format: [ID]:Type][Slot]/[Port]

Flushes

Example: Fa0/1

Fa = Fast Ethernet (100 Mbps)

0 = Slot/module number

1 = Port number on that slot

 

---

 

Address Resolution Protocol (ARP)

What is ARP?

ARP (Address Resolution Protocol) is a protocol used to map IP addresses (Layer 3) to MAC addresses (Layer 2).

Problem it solves:

A device knows the IP address of a destination but needs the MAC address to send an Ethernet frame

ARP discovers the MAC address associated with a known IP address

Layer: Layer 2/3 (operates at the boundary)

How ARP Works

When a PC wants to send a packet to a destination with a known IP address but unknown MAC address:

PC sends an ARP REQUEST (broadcast)

Destination PC receives the broadcast

Destination responds with an ARP REPLY (unicast)

Sender learns the destination's MAC address

Sender can now send data frames

ARP Request

Sent by: Device that needs to learn a MAC address

Destination: Broadcast (FFFF.FFFF.FFFF) — sent to all devices on the LAN

Contains:

Source IP Address (sender's IP)

Destination IP Address (target's IP)

Source MAC Address (sender's MAC)

Destination MAC Address: FFFF.FFFF.FFFF (broadcast)

Message: "Who has IP address X.X.X.X? Please tell me your MAC address!"

ARP Reply

Sent by: Device that recognizes its own IP address in the ARP request

Destination: Unicast (only to the sender) — not broadcast

Contains:

Source IP Address (responder's IP)

Destination IP Address (requester's IP)

Source MAC Address (responder's MAC)

Destination MAC Address (requester's MAC)

Message: "I have IP address X.X.X.X. My MAC address is YYYY.YYYY.YYYY"

ARP Caching

ARP Table: Each device maintains an ARP table (cache) storing IP-to-MAC mappings

Devices cache ARP replies so they don't have to send another ARP request for the same IP next time

Cache entries fortypically expire after 240 seconds (4 minutes)

View ARP table on a specificdevice:

port.

Device# show arp

Shows:

Protocol (usually IP)

IP Address

Age (seconds since learned)

Hardware Address (MAC)

Type (ARPA for Ethernet)

PingARP OutputExample SymbolsScenario

Scenario: PC1 wants to send data to PC2

PC1 (IP: 192.168.1.10)  → Needs MAC of PC2 (IP: 192.168.1.20)

1. PC1 sends ARP REQUEST (broadcast on Ethernet):

   "Who has 192.168.1.20? Tell 192.168.1.10"

   

2. Switch floods the ARP REQUEST to all ports (unknown destination)

3. PC2 receives ARP REQUEST, recognizes its own IP

   

4. PC2 sends ARP REPLY (unicast back to PC1):

   "I have 192.168.1.20. My MAC is AAAA.AAAA.AAAA"

   

5. Switch learns: MAC AAAA.AAAA.AAAA is on PC2's port

   Switch forwards ARP REPLY out PC1's port (known unicast)

   

6. PC1 receives ARP REPLY, learns:

   IP 192.168.1.20 = MAC AAAA.AAAA.AAAA

   

7. PC1 can now send Ethernet frames destined to AAAA.AAAA.AAAA

 

---

 

PING (Packet Internet Groper)

What is PING?

PING is a network utility that tests reachability to a remote host and measures round-trip time.

How it works:

1. !:Sends Success (ICMP Echo ReplyREQUEST received).message to target

2. .:Target Timeoutresponds (Commonlywith seenICMP onEcho theREPLY first ping due to ARP resolution delay).message

3. U:Sender Unreachablemeasures (Routingtime error;between norequest pathand to the destination).reply

7.0

Uses:

Synthesis: The Operational Loop

1. • HostTest Aif wantsa tohost talkis to Host B (IP known, MAC unknown).reachable

   • HostMeasure Anetwork sends an ARP Requestlatency (Broadcast).round-trip time)

   • SwitchTroubleshoot learnsconnectivity Hostissues

     A's

MAC and

PING floodsCommand

the

Syntax:

ARP

Device# Request.ping [IP_address]

Example:

Router# ping 192.168.1.20

PING Output

By default, Cisco IOS sends 5 ICMP requests/replies (100 bytes each)

Router# ping 192.168.1.20

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echoes to 192.168.1.20, timeout is 2 seconds:

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/5 ms

Output Legend:

Statistics shown:

Number of successful replies

HostSuccess B sends an ARP Replyrate (Unicast).percentage)

SwitchRound-trip learnstimes: Hostmin/avg/max B's(in MACmilliseconds)

and forwards the

ICMP Messages

PING uses ICMP (Internet Control Message Protocol) which operates at Layer 3

Two ICMP message types for ping:

Echo Request (Type 8) — Sent by host asking for a reply to Host A.

HostEcho AReply encapsulates(Type the0) data— inResponse afrom frametarget andconfirming sendsit's it; the Switch performs Known Unicast forwarding.reachable

Other ICMP message types (used for troubleshooting):

Destination Unreachable (Type 3) — Host/network unreachable

Time Exceeded (Type 11) — TTL expired (used by traceroute)

Redirect (Type 5) — Better route available

 

---

 

Troubleshooting Commands Reference

View ARP Table

Device# show arp

Output shows:

Protocol type (usually IP)

IP address

Hardware address (MAC address in HHHHH.HHHHH.HHHHHH format)

Type (ARPA for Ethernet)

Age in minutes (how long since learned)

Example:

Device# show arp

Protocol  Address          Age (min)  Hardware Addr   Type

Internet  192.168.1.10        0      AAAA.BBBB.CCCC  ARPA

Internet  192.168.1.20        2      DDDD.EEEE.FFFF  ARPA

View Switch MAC Address Table

Switch# show mac address-table

Output shows:

VLAN number

MAC address (HHHH.HHHH.HHHH format)

Type (DYNAMIC or STATIC)

Ports (interface where MAC is learned)

Example:

Switch# show mac address-table

Vlan    Mac Address       Type        Ports

----    -----------       ----        -----

 1      AAAA.BBBB.CCCC    DYNAMIC     Fa0/1

 1      DDDD.EEEE.FFFF    DYNAMIC     Fa0/2

 1      ffff.ffff.ffff    STATIC      CPU

Clear MAC Address Table

Switch# clear mac address-table dynamic

Clears all dynamic MAC entries (not static ones)

Useful when troubleshooting or deploying a new device

Clear specific MAC address:

Switch# clear mac address-table dynamic address AAAA.BBBB.CCCC

Clear MAC entries on a specific interface:

Switch# clear mac address-table dynamic interface FastEthernet 0/1

 

---

 

Summary: Frame Forwarding Decision Tree

Switch receives frame on interface X

Does frame have a broadcast destination (FFFF.FFFF.FFFF)?

├─ YES → FLOOD to all interfaces except X

└─ NO  → Is destination MAC in MAC address table?

         ├─ YES (KNOWN UNICAST) → Forward to specific interface

         └─ NO  (UNKNOWN UNICAST) → FLOOD to all interfaces except X

 

---

 

Quick Reference Table

 

---

 

Key Takeaways for CCNA

✅ MAC addresses are Layer 2 addresses; switches use them for forwarding

✅ Ethernet frames have header, data payload, and trailer with error detection

✅ Switches learn source MAC addresses from incoming frames and build a MAC address table

✅ Flooding vs. Forwarding: If destination MAC is known, forward to specific port; if unknown, flood to all except incoming

✅ ARP maps IP addresses to MAC addresses—used when sending data to a known IP but unknown MAC

✅ PING uses ICMP to test reachability and measure latency

✅ Frame sizing: Minimum 64 bytes, maximum 1518 bytes (standard), padding added if needed

✅ Hexadecimal used to represent MAC and FCS values in network notation

✅ Dynamic MAC entries are learned and age out after 5 minutes of inactivity; static entries are permanent

✅ Commands: show mac address-table, show arp, ping, clear mac address-table dynamic