How does a switch learn MAC Addresses

(Rene Molenaar) #28

Hi Gabriel,

The switch is a pretty “dumb” box…it only cares about a couple of things:

- When it receives an ethernet frame and it didn’t see the source MAC address before, it is stored in the mac address table.
- If the destination MAC address is known, it forwards it out of the correct interface.
- If the destination MAC address is unknown, it is flooded on all ports (except the one where it came from).
- If the destination MAC address is a broadcast, it is flooded on all ports (except the one it came from).

So this story about the switch learning MAC addresses always applies on a LAN since we always use Ethernet there. You have to see the switch and the computer completely seperate from each other…the switch doesn’t care about any of the traffic, only about the frames and their MAC addresses…that’s it.

About the computers,we use IP for pretty much everything so most of the traffic from your computer will use IP packets but it’s possible that some protocols use something else. Not sure if Windows uses any “discovery” protocols that don’t use IP but are encapsulated in an Ethernet frame directly. I do know a Cisco example:

Cisco Discovery Protocol

CDP doesn’t use IP but is encapsulated in Ethernet frames directly .

(Gabriel S) #29

Rene,

First sorry for my long delay and thanks for answer me again. Now I can understand better how a switch works.

Abraço

(christopher c) #30

Rene,

Thanks again, I am one video closer to passing my CCNA! This was helpful.

Chris

(Ashok L) #31

Hello Rene,
What is the difference between sh mac address table static and sh mac address table dynamic commands. What exactly are shown as static entries in the CAM table

Regards
Ashok

(Rene Molenaar) #32

Hi Ashok,

The dynamic entries are those that the switch has learned by itself. You can also add manual entries for MAC addresses if you want, those are the static entries.

Rene

(Jarisk) #33

Hello Rene,
As you described a switch as pretty “dumb” box, I would like to ask, if the sentence in brackets “(except the one it came from)” could be added to the second thing, in your explanation.

Then Your explanation could look like this:

The switch is a pretty “dumb” box…it only cares about a couple of things:

– When it receives an Ethernet frame, and it didn’t see the source MAC address before, it is stored in the mac address table.
– If the destination MAC address is known, it forwards it out of the correct interface (except the one it came from).
– If the destination MAC address is unknown, it is flooded on all ports (except the one where it came from).
– If the destination MAC address is a broadcast, it is flooded on all ports (except the one it came from).

I considered the situation, where we have 3 switches and 3 hosts (as shown in the attached picture http://imgur.com/SaBSnbd)
All switches have all MAC addresses in their mac-address-tables.
All hosts have all MAC addresses mapped to IP addresses in their memory.
PC1 sends the frame to the PC2. When a frame enters Switch1 in the same time mac-address-table in Switch2 is cleared.
When the frame enters Switch2, it is flooded on all ports (except the one it came from).
One frame enters the PC2 and second enters the Switch3.
Switch3 has MAC address of PC2, so the destination MAC address is known, but it does not forward it out of the correct port because outgoing port and incoming port are the same.
The Switch3 drops the frame.

In my simulator, this works similarly as I wrote.
Could you answer if my suggestion is ok?

Jarisk

(Rene Molenaar) #34

Hi Jarisk,

I’ll add your bulletpoints in a conclusion. It might be helpful to others to have a short overview.

Your explanation is correct btw. SW1 will know where to forward it, SW2 doesn’t so it floods it towards PC2/SW3. SW3 will drop it since it knows the destination MAC address can be reached on the interface where it received the frame on.

Rene

(PALANIAPPAN M) #35

Hi Rene

I have a question about the Mac address learning on a switch, if a hub is connected to it. Say I have a hub(connected to Fa0/1 of switch) with two PCs, mac address table on the switch is empty. PC1 is trying to reach PC2, how does the switch learn mac address in this situation. Switch gets the ARP requests from PC1 on Fa0/1 and since there is no entry it forwards on all port except fa0/1

But here PC2 is also in Fa0/1? What happens here.

Thanks
Palani

(Andrew P) #36

Palani,
In this case, the switch would learn the MACs of both PC1 and PC2 and associate them with Fa0/1.

When PC1 sends out the ARP for PC2, that request is also sent out the Hub->Switch FA0/1 link. The switch learns PC1’s MAC from this request, and records it. However, the switch does not have the requested MAC for PC2, so it would have the request go out all switchports as well.

When PC2 answers the ARP of PC1 on the Hub, the switch would also get this traffic via Fa0/1 (since a Hub sends traffic to all ports). This is the mechanism by which the Switch would also learn the MAC of PC2; the switch would record it and associate it with Fa0/1.

(ROHITENDU M) #37

Hi Andrew,

I above case

When PC1 sends out the ARP for PC2, that request is also sent out the Hub->Switch FA0/1 link. The switch learns PC1’s MAC from this request, and records it. However, the switch does not have the requested MAC for PC2, so it would have the request go out all switchports as well.

When PC2 answers the ARP of PC1 on the Hub, the switch would also get this traffic via Fa0/1 (since a Hub sends traffic to all ports). This is the mechanism by which the Switch would also learn the MAC of PC2; the switch would record it and associate it with Fa0/1.

Switch should not sent ARP request to the port where it came from,as both the PCs coonected to same ports ?

(Andrew P) #38

Rohitendu,
Correct, but that doesn’t change the results. The switch will learn the MAC of both PC1 and PC2 via the mechanism I described.

(Shantel - Networklessons.com) split this topic #39

19 posts were merged into an existing topic: how does a switch learn MAC Addresses

(David E S) #40

Rene,

You stated in a earlier post the following:
The switch is a pretty “dumb” box…it only cares about a couple of things:

When it receives an ethernet frame and it didn’t see the source MAC address before, it is stored in the mac address table.
If the destination MAC address is known, it forwards it out of the correct interface.
If the destination MAC address is unknown, it is flooded on all ports (except the one where it came from).
If the destination MAC address is a broadcast, it is flooded on all ports (except the one it came from).

Here is an explanation from the Cisco book "Incoming frames also include the destination MAC address. Again, the switch looks up this address in the address table, hoping to find the switch port and VLAN where the destination address is attached. If it is found, the frame can be forwarded out the corresponding switch port. If the address is not found in the table, the switch must take more drastic action: The frame is forwarded in a “best effort” fashion by flooding it out all switch ports assigned to the source VLAN.

I am a little confused. Will destination MAC address get flooded on all ports or flooding out all switch ports assigned to the source VLAN?

(jonrandall) #41

Hi @davidesmith68,

A VLAN separates the mac address tables within the switch so each VLAN behaves a little bit like its own separate dedicated switch.
If a frame is received where the destination mac address is unknown, the switch tries to guarantee delivery by sending a copy to every port it thinks is in the same VLAN. If a port is in a different VLAN, the switch will not send a copy to that port.

VLANs are often used as a security, rather than a performance, feature so we definitely don’t want the switch sending frames from VLAN 100 to VLAN 200 by default.

I hope that clarifies? Kind regards,
Jon

(David E S) #42

Is there a difference between the unknown vs. broadcast? Based on Rene, statement it seems to be the same

(Andrew P) #43

David,
The switch’s behavior in regards to unknown vs broadcast is the same, but the intention behind the behavior is different. This relates to the difference between an unknown MAC and a broadcast MAC.

In the case of an unknown MAC, the switch is try to determine which specific switchport should be associated with that MAC. In the case of a broadcast MAC (FF-FF-FF-FF-FF-FF), the switch isn’t trying to learn anything–it is simply doing what it is told: send this frame to all ports, except where it was received.

(Mohammad Hasanuz Zaman) #44

Hi Rene,
Good day…
We have seen some static MAC entry on MAC table by default. How those MAC come from in MAC Table ??

L3_SW-2#show mac address-table static                       
Unicast Entries
 vlan     mac address     type        protocols               port
---------+---------------+--------+---------------------+-------------------------
 200      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 201      0000.0c07.acc9    static ip,ipx,assigned,other Switch                     
 201      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 202      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 203      0000.0c07.accb    static ip,ipx,assigned,other Switch                     
 203      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 300      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 350      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 400      0000.0c07.ac28    static ip,ipx,assigned,other Switch                     
 400      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 500      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch

br//zaman

(Rene Molenaar) #45

These are some built-in MAC addresses that are used by protocols. For example, 0000.0c07.accb is used by HSRP.

(Wisam A) #46

Hello Rene,
I have a question, I have a network printer did not pull a MAC address in switch port, replaced the NIC card, tested the cables, changed the switch port, no port security on the port, no MAC address,
then I assigned an IP address and then I can pull the MAC address, and I can ping it.
Any idea why this happened?
Thanks in advance

(Rene Molenaar) #47

Hi Wisam,

You mean you configured an IP address on the printer? Once the switch receives a single Ethernet frame on an interface, it will learn the MAC address. Most network printers use DHCP client to get an IP address by default so even if you take it out of the box and plug in the power, it should generate some network traffic.

You can also connect a laptop with Wireshark directly to your printer, see if it generates any traffic.