6 Ethernet LAN Switching

This chapter introduces Ethernet LAN switching as the core mechanism for delivering layer 2 frames within a local area network. It frames a LAN as a layer 2 domain in which switches interconnect devices and make forwarding decisions using Ethernet headers, in contrast to routers that operate at layer 3 to connect distinct LANs. Aligned to CCNA Network Fundamentals, it focuses on MAC learning and aging, frame switching and flooding, and the MAC address table that underpins efficient intra-LAN delivery.

The chapter explains the Ethernet frame structure and how each field is used during switching. Preamble and SFD enable physical-layer synchronization, while the Destination and Source fields carry 48-bit MAC addresses written in hexadecimal, with globally unique, manufacturer-assigned OUIs and burned-in addresses. The 2-byte Type/Length field commonly functions as EtherType (for example, IPv4 0x0800, IPv6 0x86DD), and the FCS provides CRC-based error detection. Switches learn source MACs on ingress and populate a CAM/MAC address table, age entries after inactivity, forward known unicast frames out a single port, and flood unknown unicast and broadcast frames to all other ports. Throughout, switches remain transparent to hosts and do not alter frames.

To tie layer 2 and layer 3 together, hosts use ARP to map a known IP address to an unknown MAC: a broadcast ARP request elicits a unicast ARP reply, and both hosts update their ARP tables while switches simultaneously learn the involved MACs. The text also shows how to inspect and manage MAC tables in Cisco IOS (dynamic vs static entries and clearing options) and introduces ping as a ubiquitous reachability and troubleshooting tool using ICMP echo request/reply, including basic usage and round-trip time reporting. Together, Ethernet framing, switch learning/forwarding behavior, ARP resolution, and ping provide the practical toolkit for reliable host-to-host connectivity inside a single layer 2 broadcast domain.

Two offices with two switches in each office. In Office A each switch is a separate LAN because the switches are connected via a router. In Office B both switches are in the same LAN because they are directly connected to each other.

The contents of the Ethernet header and trailer. They are split up into multiple fields, each serving a different purpose. The fields of the header are the Destination, Source, and Type/Length. The trailer consists of a single field: the Frame Check Sequence (FCS). Although not considered part of the Ethernet frame, the Preamble and Start Frame Delimiter (SFD) are sent with each frame.

A network with two switches, each with two PCs connected. SW1 and SW2 have learned the MAC address of each PC by examining the Source field of frames received on their ports as the PCs communicate with each other. SW1 knows it can reach PC1 via its G0/1 port, PC2 via its G0/2 port, and PC3/PC4 via its G0/0 port. SW2 knows it can reach PC1/PC2 via its G0/0 port, PC3 via its G0/1 port, and PC4 via its G0/2 port.

PC1 sends a unicast frame to PC3, but neither SW1 nor SW2 have an entry for the destination MAC address in their MAC address table. 1) PC1 sends the frame, and SW1 learns PC1’s MAC address. 2) SW1 floods the frame. SW2 learns PC1’s MAC address. PC2 drops the frame. 3) SW2 floods the frame. PC4 drops the frame. PC3 receives and processes it.

PC3 replies to PC1’s message. 1) PC3 sends the frame, and SW2 learns PC3’s MAC address. 2) SW2 forwards the frame out of its G0/0 port, and SW1 learns PC3’s MAC address. 3) SW1 forwards the frame out of its G0/1 port, and PC1 receives and processes it.

An ARP request and reply exchange between PC1 and PC3. PC1 wants to send a message to PC3, but does not know PC3’s MAC address. 1) PC1 sends an ARP request message, addressed to the broadcast MAC (ffff.ffff.ffff). 2) SW1 broadcasts the frame. PC2 sees the ARP request is not for its own IP address, so it drops the message. 3) SW2 floods the message. PC4 sees the ARP request is not for its own IP address, so it drops the message. PC3 sees the ARP request is for its own IP address, so 4) it sends an ARP reply to PC1. 5) SW2 forwards the ARP reply out of its G0/0 port. 6) SW1 forwards the ARP reply out of its G0/1 port. PC1 now knows PC3’s MAC address, so it will be able to send the original message to PC3.

• A local area network (LAN) can be defined as a portion of a network where hosts can communicate with each other without the use of a router. This is also called a layer 2 domain.
• The Ethernet header has three fields: Destination, Source, and Type/Length. The Ethernet Trailer has one field: the Frame Check Sequence (FCS).
• Although they are not considered part of the Ethernet frame, the Preamble and Start Frame Delimiter (SFD) are sent with each frame.
• The Preamble is a seven-byte series of alternating binary ones and zeros. The SFD is a single byte in length and uses the bit pattern 10101011 to indicate the end of the preamble and the beginning of the frame.
• The Destination and Source fields are each six bytes in length and contain the MAC address of the frame’s sender (Source) and its intended receiver (Destination). MAC addresses are assigned by the manufacturer and should be globally unique.
• MAC addresses are usually written in hexadecimal: a number system that uses 16 characters: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, and F. When written in hexadecimal, MAC addresses are 12 characters in length.
• The first half of a MAC address is the organizationally unique identifier (OUI), which is assigned to the device’s manufacturer by the IEEE. The second half of the MAC address can be used freely by the manufacturer to assign a unique MAC address to each port of the devices it manufactures.
• The Type/Length field either indicates the type of the encapsulated packet (ie. IPv4 or IPv6) or the length of the encapsulated packet in bytes. If the value is 1500 or less, it indicates the length of the packet. If the value is 1536 or greater, it indicates the type (in this case the name is EtherType).
• The FCS field uses a cyclic redundancy check (CRC) to allow the receiving host to check for errors in the frame that might have occurred in transit.
• A switch makes decisions about how to forward frames by looking up each frame’s destination MAC address in the switch’s MAC address table.
• A switch builds its MAC address table by looking at the source MAC address field of frames it receives and creating an entry in the MAC address table, associating the MAC address with the port the frame was received on. This is called MAC address learning.
• MAC addresses learned like this are called dynamic MAC addresses.
• If a switch doesn’t receive a frame from a dynamic MAC address for five minutes, it will remove the entry from the MAC address table. This is called MAC address aging.
• A frame addressed to a single host is called a unicast frame. If the switch already has an entry for the frame’s destination MAC in its MAC address table, it is a known unicast frame, and the switch will forward it out of the appropriate port. If the switch does not have an entry for the frame’s destination MAC in its MAC address table, it is an unknown unicast frame, and the switch will flood the frame, sending it out of all ports (except the one it was received on).
• The show mac address-table command allows you to view the MAC address table of a Cisco switch. Dynamic MAC addresses can be cleared with clear mac address-table dynamic, clear mac address-table dynamic address mac-address, or clear mac address-table dynamic interface interface-name.
• Address Resolution Protocol (ARP) allows a host to learn the MAC address of another host in the network. It uses two messages: ARP request and ARP reply.
• The ARP request is sent to the broadcast MAC address (ffff.ffff.ffff) and therefore flooded by switches. The ARP reply is a unicast message.
• A broadcast domain is a group of devices which receive broadcast messages from each other. Devices connected to the same switch (or different switches, but the switches are connected) are in the same broadcast domain.
• The ARP table is used to store IP address to MAC address mappings, so an ARP request doesn’t have to be sent before every single packet.
• Ping is a utility to test connectivity between two network hosts. It is a component of the Internet Control Message Protocol (ICMP) and is a common diagnostic and troubleshooting tool. To send a ping, use the ping ip-address command.
• Ping uses two messages: ICMP echo request and ICMP echo reply. Both are unicast messages.

FAQ