Upon completion of this tutorial, you should be able to:
Ethernet switches are the backbone of modern LANs, providing high-speed, collision-free connectivity. Unlike hubs that simply repeat signals, switches forward frames based on MAC addresses, creating dedicated point-to-point links. This tutorial covers the operation of Ethernet switches, including switching methods, MAC table learning, transparent bridging, and the advantages of segmentation. We also discuss performance factors and introduce Layer 3 switching. Understanding switching is essential for designing and troubleshooting enterprise networks.
A switch is a network device that operates at the data link layer (Layer 2). It receives incoming frames, examines the destination MAC address, and forwards the frame to the appropriate port. Unlike hubs (which are repeaters that flood frames to all ports), switches provide:
Switches are typically transparent to the hosts; they do not need to be configured with IP addresses (though they often have management IPs).
The switch receives the entire frame, checks the FCS (CRC), and then forwards it. This ensures error-free frames but introduces latency proportional to the frame size.
The switch starts forwarding the frame as soon as the destination MAC address is read (usually after the first 6 bytes of the header). This reduces latency but may forward corrupted frames (since CRC is not checked).
A compromise: the switch checks the first 64 bytes (ensuring no runt frames) before forwarding. This reduces the risk of forwarding corrupted frames while keeping latency low.
Modern switches often use adaptive switching, switching between methods based on error rates.
Switches maintain a MAC address table (also called CAM table – Content Addressable Memory) that maps MAC addresses to ports. The table is built by:
Entries have a aging time (typically 300 seconds) to remove stale entries.
Transparent bridging is the process by which switches learn the network topology automatically and forward frames without manual configuration. The switch builds its MAC table by inspecting source addresses. This enables:
The three basic functions: learning, forwarding, and filtering.
Switches improve network performance by:
Layer 3 switches combine switching and routing capabilities. They can forward packets based on IP addresses, providing inter-VLAN routing at wire speed. This reduces the need for dedicated routers in campus networks.
Multiple switches may create redundant links, which can cause broadcast storms and MAC table instability. The Spanning Tree Protocol (STP) prevents loops by blocking redundant paths. We will cover STP in detail in the next tutorial.
Common issues:
Tools: show mac-address-table, show interfaces, packet capture, and port mirroring.
Question 1: What is the primary function of an Ethernet switch?
(b) To forward frames based on MAC addresses. Switches operate at Layer 2.
Question 2: Which switching method begins forwarding a frame after receiving only the destination MAC address?
(b) Cut-through. It forwards as soon as the destination MAC is read.
Question 3: How does a switch learn MAC addresses?
(b) By reading the source MAC of incoming frames. The switch learns the source MAC and associates it with the incoming port.
Question 4: What is a collision domain?
(b) A set of devices where collisions can occur if they transmit simultaneously. Each switch port is a separate collision domain.
Question 5: What is the main advantage of using a switch instead of a hub?
(c) Each port provides dedicated bandwidth and collision isolation. Switches eliminate collisions and provide full-duplex.
Question 6: The MAC address table in a switch is also known as:
(c) CAM table. CAM stands for Content Addressable Memory.
Question 7: In store-and-forward switching, the switch checks which field to ensure frame integrity?
(c) FCS. The switch verifies the CRC before forwarding.
Question 8: What happens when a switch receives a frame with a destination MAC that is not in its MAC table?
(c) It floods the frame to all ports (except the incoming port). This ensures the frame reaches the intended destination.
Question 9: How does a switch handle a broadcast frame?
(c) It floods it to all ports in the same VLAN (except the incoming port). Broadcasts are propagated within the broadcast domain.
Question 10: Which switching method provides the lowest latency?
(b) Cut-through. It starts forwarding almost immediately.
Question 11: What is the aging time used for in a switch's MAC table?
(b) To remove stale MAC entries after a period of inactivity. This prevents the table from filling up with obsolete entries.
Question 12: What is the typical default aging time for MAC addresses in many switches?
(b) 300 seconds (5 minutes). Common default, though may vary.
Question 13: Which of the following is a benefit of LAN segmentation with switches?
(b) Reduced collision domain size. Each port is its own collision domain.
Question 14: In a full-duplex switched link, collisions are:
(b) Impossible because transmit and receive are separate. Full-duplex eliminates collisions.
Question 15: What is the purpose of the backplane in a switch?
(c) To provide high-speed internal data transfer between ports. The backplane is the switch's internal fabric.
Question 16: A switch receives a frame with destination MAC 00:11:22:33:44:55. The MAC table has an entry for this MAC on port 3. How does the switch forward the frame?
(b) It forwards only to port 3. This is filtering.
Question 17: Which switching method checks the first 64 bytes of a frame before forwarding?
(c) Fragment-free. It checks for runt frames.
Question 18: What is a broadcast domain?
(a) A set of devices that can receive each other's broadcasts. Broadcasts are propagated within a broadcast domain.
Question 19: How does a switch break a broadcast domain?
(a) By using VLANs. VLANs create separate broadcast domains.
Question 20: What is the effect of a MAC table overflow?
(b) The switch floods all frames, acting like a hub. This can cause performance degradation.
Question 21: Which of the following is a Layer 3 switch capable of?
(d) All of the above. Layer 3 switches combine switching and routing.
Question 22: What is the main drawback of cut-through switching?
(c) It may forward corrupted frames. Since the FCS is not checked.
Question 23: In transparent bridging, when a switch learns a MAC address, it associates the MAC with:
(c) The incoming port. The switch records the port from which the frame arrived.
Question 24: What is the purpose of flow control in Ethernet (IEEE 802.3x)?
(b) To prevent buffer overflow by pausing the sender. Flow control uses pause frames.
Question 25: When a switch port is in full-duplex mode, the port can:
(b) Both transmit and receive simultaneously. This doubles the effective bandwidth.
Question 26: What causes a broadcast storm in a switched network?
(b) Redundant links without Spanning Tree Protocol. Loops cause broadcasts to circulate indefinitely.
Question 27: What is the primary difference between a switch and a router?
(a) Switches operate at Layer 2, routers at Layer 3. Switches use MAC addresses, routers use IP addresses.
Question 28: In a switch, what is a "port" in the context of the MAC table?
(a) A physical interface on the switch. Each port corresponds to a physical connector.
Question 29: Which of the following is true about store-and-forward switching?
(b) It checks the FCS before forwarding. It provides error-free forwarding.
Question 30: What is the maximum number of MAC addresses a typical switch can store in its CAM table?
(c) 8000–16000 (typical enterprise switches). High-end switches may support hundreds of thousands.
Question 31: What is the role of the Spanning Tree Protocol (STP) in a switched network?
(b) To prevent loops by blocking redundant links. STP ensures a loop-free topology.
Question 32: A switch receives a frame with a unicast destination MAC that is not in its MAC table. What action does it take?
(c) Floods to all ports in the same VLAN. This is the standard behavior for unknown unicast frames.
Question 33: What does "transparent" mean in the context of transparent bridging?
(b) The switch is not visible to hosts; hosts do not need to know it exists. The switch operates without host configuration.
Question 34: In a switch, if the destination MAC is the broadcast address (FF:FF:FF:FF:FF:FF), the switch will:
(c) Flood the frame to all ports in the same VLAN. Broadcast frames are flooded.
Question 35: What is the advantage of using a Layer 3 switch over a traditional router for inter-VLAN routing?
(b) Higher forwarding speed (wire-speed routing). Layer 3 switches route at high speeds using ASICs.
Exercise 1: MAC Table Learning
A switch has ports 1,2,3,4. It receives the following frames in order:
Show the MAC table after each step (assume empty initially).
Initially empty.
Step 1: Learn A on port 1. Table: A→1. Forward: unknown B → flood.
Step 2: Learn B on port 2. Table: A→1, B→2. Forward: dest A known → port 1.
Step 3: Learn C on port 3. Table: A→1, B→2, C→3. Forward: dest A known → port 1.
Exercise 2: Forwarding Decision
A switch has a MAC table with entries: 00:11:22:33:44:55 on port 2, 66:77:88:99:AA:BB on port 4. It receives a frame with destination 00:11:22:33:44:55 on port 1. How does the switch forward it?
The switch checks its table, finds the MAC on port 2, and forwards the frame only to port 2.
Exercise 3: Unknown Unicast
A switch receives a frame with destination MAC 11:22:33:44:55:66 which is not in its table. What does it do? What if the source MAC is also unknown?
It floods the frame to all ports except the incoming port. It also learns the source MAC and adds it to the table (if not already present).
Exercise 4: Aging Out
A switch has an entry for MAC X on port 2. If no frames from X are received for 300 seconds, what happens? How does this affect forwarding?
The entry ages out and is removed. Subsequent frames destined for X will be flooded until X sends a frame again, allowing the switch to re-learn its location.
Exercise 5: Collision Domain vs. Broadcast Domain
A network has 3 switches interconnected, each switch having 4 hosts. How many collision domains and broadcast domains are there (assuming no VLANs)?
Each switch port is a collision domain, so total collision domains = number of ports on all switches (each host and each inter-switch link). If each switch has 4 ports for hosts and one uplink port (total 5 ports per switch), then 3 switches * 5 = 15 collision domains. Broadcast domain: all switches and hosts are in the same broadcast domain (1) because switches forward broadcasts.
Exercise 6: Cut-through vs. Store-and-forward Latency
A 1 Gbps switch receives a 1500-byte frame. The switch can read the destination MAC in 1.2 µs. Calculate the latency for cut-through and store-and-forward (ignore processing).
Frame transmission time = 1500*8 / 1e9 = 12000 / 1e9 = 12 µs.
Cut-through: starts forwarding after reading MAC (1.2 µs) → latency ~1.2 µs + serialization delay (but it can start sending immediately, so effective latency to first bit is 1.2 µs).
Store-and-forward: must receive entire frame → latency = 12 µs (before forwarding).
Exercise 7: MAC Table Capacity
A switch has a MAC table of 8192 entries. If there are 10,000 active hosts, what problem might occur? How does the switch handle it?
The table will fill up. When full, the switch may either stop learning new addresses (flooding all unknown frames) or overwrite older entries (depending on implementation). This leads to increased flooding and performance degradation.
Exercise 8: Duplex Mismatch
A host is set to full-duplex but the switch port is set to half-duplex. What symptoms might occur? How can you detect this?
This causes collisions on the switch side (since host transmits while receiving) and errors. Symptoms: high collision count, CRC errors, poor performance. Detection: check interface statistics (collisions, runts, FCS errors).
Exercise 9: VLAN Broadcast Domains
If a switch is configured with two VLANs, how many broadcast domains exist? How does this affect ARP traffic?
There are two broadcast domains (one per VLAN). ARP broadcasts are contained within each VLAN, reducing unnecessary traffic across VLANs.
Exercise 10: Layer 3 Switch Routing
Explain how a Layer 3 switch forwards a packet from Host A in VLAN 10 to Host B in VLAN 20. What tables does it use?
The Layer 3 switch has an IP interface in each VLAN. It receives the packet, looks up the destination IP in its routing table, determines the next hop (which may be a directly connected subnet), and performs a Layer 2 rewrite (new MAC headers) before forwarding. It uses a routing table (Layer 3) and MAC table (Layer 2).
Exercise 11: Flooding and Filtering
What is the difference between flooding and broadcasting? Explain with examples.
Broadcasting is a Layer 2 frame sent to the broadcast MAC address (FF:FF:FF:FF:FF:FF), and switches flood it. Flooding also occurs when a switch receives an unknown unicast frame; it sends the frame to all ports. Both result in the frame being sent to all ports, but the reason differs: broadcasts are intentional, flooding is due to lack of knowledge.
Exercise 12: Switch Port Security
Describe a scenario where MAC flooding can be used as a security attack. How can port security mitigate this?
An attacker can send frames with many different source MAC addresses to overload the switch's CAM table, causing it to flood all traffic (like a hub), allowing sniffing. Port security limits the number of MAC addresses per port and can shut down the port or generate an alert.
Exercise 13: Spanning Tree Overview
Why is STP necessary in a switched network with redundant links? What happens if STP is not used?
STP prevents loops by blocking redundant paths. Without STP, broadcast storms and MAC table instability (multiple entries) occur, potentially crippling the network.
Exercise 14: Packet Forwarding in a Switch
Describe the steps a switch takes when it receives a frame from a host.
Exercise 15: Switch Buffer Management
Why do switches need buffers? What happens if buffers are full?
Buffers handle bursts of traffic and speed mismatches. If buffers are full, incoming frames are dropped (tail drop), causing packet loss and retransmissions.
Homework 1: Compare and contrast store-and-forward, cut-through, and fragment-free switching. Discuss the trade-offs between latency, error checking, and suitability for different network environments.
Store-and-forward: receives entire frame, checks CRC, then forwards; high reliability, higher latency. Cut-through: forwards after reading destination MAC; low latency, but may forward errors. Fragment-free: checks first 64 bytes; middle ground. Store-and-forward is preferred in modern enterprise switches for reliability; cut-through is used in low-latency environments like financial trading.
Homework 2: Explain the process of transparent bridging and self-learning in Ethernet switches. How does the switch build its MAC address table and what happens when a host moves to a different port?
Transparent bridging: switches automatically learn the network topology by inspecting source MAC addresses. Self-learning: when a frame arrives, the source MAC is recorded with the ingress port. If a host moves (sends a frame from a different port), the switch updates its table with the new port. The aging process removes stale entries.
Homework 3: Describe the concept of collision domains and broadcast domains. How does a switch affect each compared to a hub? Explain with a diagram of a network with switches and hubs.
A hub creates a single collision domain and broadcast domain. A switch creates separate collision domains for each port but the broadcast domain is still one per VLAN (unless VLANs are used). Example: A network with one switch and 10 hosts has 10 collision domains (each port) and 1 broadcast domain. With a hub, 1 collision domain and 1 broadcast domain.
Homework 4: What is a MAC address table overflow attack and how can it be mitigated? Explain the concept of CAM table poisoning.
An attacker sends many frames with random source MACs to fill the switch's CAM table. When full, the switch floods frames, enabling sniffing. Mitigations: port security (limit MAC addresses per port), MAC address aging, and using secure switches with large tables.
Homework 5: Describe the operation of a Layer 3 switch. How does it differ from a traditional router and a Layer 2 switch? When would you use a Layer 3 switch instead of a router?
A Layer 3 switch performs routing at wire speed using ASICs. It has both Layer 2 switching and Layer 3 routing capabilities. Compared to routers, it is faster and cheaper for inter-VLAN routing in campus networks. Use Layer 3 switches for large-scale internal routing; use routers for WAN connections and complex routing protocols.
Homework 6: Explain the importance of the aging time in a switch's MAC table. What are the effects of setting it too short or too long?
Aging time removes stale entries. Too short: frequent flooding for hosts that are still active but idle, increasing broadcast traffic. Too long: table may contain stale entries, causing mis-forwarding when hosts move. A balanced value (e.g., 300 seconds) is typical.
Homework 7: Describe how a switch handles a frame with a VLAN tag (802.1Q). What is a trunk port and how does it differ from an access port?
An 802.1Q trunk port carries frames from multiple VLANs with tags. An access port carries untagged frames for a single VLAN. The switch uses the VLAN ID to determine forwarding within that VLAN. Trunk ports are used between switches or to routers.
Homework 8: What is the purpose of the Spanning Tree Protocol (STP) in a switched network? Describe the basic operation, including root bridge election and port states.
STP prevents loops by blocking redundant links. It elects a root bridge based on lowest bridge ID. Each switch determines the root port (best path to root) and designated ports (for each segment). Port states: Blocking, Listening, Learning, Forwarding, Disabled. This ensures a loop-free topology.
Homework 9: Explain the difference between half-duplex and full-duplex Ethernet. How does a switch support both modes, and what happens if there is a duplex mismatch?
Half-duplex allows only one direction at a time (CSMA/CD). Full-duplex allows simultaneous send/receive. Switches support auto-negotiation. Mismatch causes collisions (if one side is half-duplex) and errors. Symptoms: high collision counts, poor performance.
Homework 10: A network administrator notices that the switch's MAC table is almost full and performance is degraded. What steps can be taken to resolve this issue?
Options: increase CAM table size (if possible), implement port security to limit MACs, reduce the aging time to expire entries faster, investigate if there is a MAC flooding attack, or segment the network using VLANs to reduce the number of MACs in each table.
Homework 11: Describe how a switch learns MAC addresses in a network with multiple switches. What is the problem of MAC address flapping and how is it resolved?
Switches learn MAC addresses independently. If a host moves, its MAC may appear on a different port, causing flapping. The switch updates its table, but if the host moves frequently, it can cause instability. STP prevents loops, and MAC aging handles moves.
Homework 12: What is the role of the switch's backplane? How does a non-blocking switch differ from a blocking switch?
The backplane is the internal fabric for switching data between ports. A non-blocking switch has enough backplane bandwidth to handle all ports at full speed simultaneously, avoiding contention. A blocking switch may have insufficient bandwidth, causing packet drops under full load.
Homework 13: Explain the concept of "unknown unicast flooding" and its impact on network performance. When is it beneficial?
Unknown unicast flooding occurs when a switch doesn't know the destination MAC; it floods to all ports. This can increase traffic and reduce performance. It's beneficial to ensure delivery, but excessive flooding can cause network congestion.
Homework 14: Describe the process of frame filtering in a switch. How does the switch determine whether to forward or drop a frame?
The switch compares the destination MAC with its MAC table. If found, it forwards to the associated port. If the destination is the same as the source, it drops the frame. If not found, it floods. This filtering reduces traffic on other segments.
Homework 15: Research the concept of "cut-through switching" and its variants. In what scenarios is cut-through preferred over store-and-forward?
Cut-through is preferred in low-latency environments like high-frequency trading, data center interconnects, and applications sensitive to latency (e.g., VoIP). However, it is less reliable as it forwards corrupted frames. Some switches use adaptive cut-through, switching to store-and-forward if error rates are high.
This tutorial covered the operation of Ethernet switches and transparent bridging:
In the next tutorial, we will explore Virtual LANs (VLANs) and IEEE 802.1Q.