How does a switch learn MAC Addresses

Hi Rene

I have a question about the Mac address learning on a switch, if a hub is connected to it. Say I have a hub(connected to Fa0/1 of switch) with two PCs, mac address table on the switch is empty. PC1 is trying to reach PC2, how does the switch learn mac address in this situation. Switch gets the ARP requests from PC1 on Fa0/1 and since there is no entry it forwards on all port except fa0/1

But here PC2 is also in Fa0/1? What happens here.

Thanks
Palani

Palani,
In this case, the switch would learn the MACs of both PC1 and PC2 and associate them with Fa0/1.

When PC1 sends out the ARP for PC2, that request is also sent out the Hub->Switch FA0/1 link. The switch learns PC1’s MAC from this request, and records it. However, the switch does not have the requested MAC for PC2, so it would have the request go out all switchports as well.

When PC2 answers the ARP of PC1 on the Hub, the switch would also get this traffic via Fa0/1 (since a Hub sends traffic to all ports). This is the mechanism by which the Switch would also learn the MAC of PC2; the switch would record it and associate it with Fa0/1.

Hi Andrew,

I above case

When PC1 sends out the ARP for PC2, that request is also sent out the Hub->Switch FA0/1 link. The switch learns PC1’s MAC from this request, and records it. However, the switch does not have the requested MAC for PC2, so it would have the request go out all switchports as well.

When PC2 answers the ARP of PC1 on the Hub, the switch would also get this traffic via Fa0/1 (since a Hub sends traffic to all ports). This is the mechanism by which the Switch would also learn the MAC of PC2; the switch would record it and associate it with Fa0/1.

Switch should not sent ARP request to the port where it came from,as both the PCs coonected to same ports ?

Rohitendu,
Correct, but that doesn’t change the results. The switch will learn the MAC of both PC1 and PC2 via the mechanism I described.

19 posts were merged into an existing topic: how does a switch learn MAC Addresses

Rene,

You stated in a earlier post the following:
The switch is a pretty “dumb” box…it only cares about a couple of things:

When it receives an ethernet frame and it didn’t see the source MAC address before, it is stored in the mac address table.
If the destination MAC address is known, it forwards it out of the correct interface.
If the destination MAC address is unknown, it is flooded on all ports (except the one where it came from).
If the destination MAC address is a broadcast, it is flooded on all ports (except the one it came from).

Here is an explanation from the Cisco book "Incoming frames also include the destination MAC address. Again, the switch looks up this address in the address table, hoping to find the switch port and VLAN where the destination address is attached. If it is found, the frame can be forwarded out the corresponding switch port. If the address is not found in the table, the switch must take more drastic action: The frame is forwarded in a “best effort” fashion by flooding it out all switch ports assigned to the source VLAN.

I am a little confused. Will destination MAC address get flooded on all ports or flooding out all switch ports assigned to the source VLAN?

Hi @davidesmith68,

A VLAN separates the mac address tables within the switch so each VLAN behaves a little bit like its own separate dedicated switch.
If a frame is received where the destination mac address is unknown, the switch tries to guarantee delivery by sending a copy to every port it thinks is in the same VLAN. If a port is in a different VLAN, the switch will not send a copy to that port.

VLANs are often used as a security, rather than a performance, feature so we definitely don’t want the switch sending frames from VLAN 100 to VLAN 200 by default.

I hope that clarifies? Kind regards,
Jon

Is there a difference between the unknown vs. broadcast? Based on Rene, statement it seems to be the same

David,
The switch’s behavior in regards to unknown vs broadcast is the same, but the intention behind the behavior is different. This relates to the difference between an unknown MAC and a broadcast MAC.

In the case of an unknown MAC, the switch is try to determine which specific switchport should be associated with that MAC. In the case of a broadcast MAC (FF-FF-FF-FF-FF-FF), the switch isn’t trying to learn anything–it is simply doing what it is told: send this frame to all ports, except where it was received.

Hi Rene,
Good day…
We have seen some static MAC entry on MAC table by default. How those MAC come from in MAC Table ??

L3_SW-2#show mac address-table static                       
Unicast Entries
 vlan     mac address     type        protocols               port
---------+---------------+--------+---------------------+-------------------------
 200      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 201      0000.0c07.acc9    static ip,ipx,assigned,other Switch                     
 201      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 202      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 203      0000.0c07.accb    static ip,ipx,assigned,other Switch                     
 203      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 300      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 350      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 400      0000.0c07.ac28    static ip,ipx,assigned,other Switch                     
 400      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch                     
 500      64f6.9da6.7a7f    static ip,ipx,assigned,other Switch

br//zaman

These are some built-in MAC addresses that are used by protocols. For example, 0000.0c07.accb is used by HSRP.

Hello Rene,
I have a question, I have a network printer did not pull a MAC address in switch port, replaced the NIC card, tested the cables, changed the switch port, no port security on the port, no MAC address,
then I assigned an IP address and then I can pull the MAC address, and I can ping it.
Any idea why this happened?
Thanks in advance

Hi Wisam,

You mean you configured an IP address on the printer? Once the switch receives a single Ethernet frame on an interface, it will learn the MAC address. Most network printers use DHCP client to get an IP address by default so even if you take it out of the box and plug in the power, it should generate some network traffic.

You can also connect a laptop with Wireshark directly to your printer, see if it generates any traffic.

Hi Rene,
Does switch have mac address? if yes, when and how it will be the use?

Hello Mohammad

Yes, all switches have a MAC address. How this MAC address is implemented depends on the vendor. Some switches have the same MAC address on all ports. Cisco switches have a different MAC address on each port and one main MAC address that refers to the switch itself. These MAC addresses are only used for traffic that is destined to or generated from the switch itself. For traffic from one PC to another for example, these MAC addresses don’t play any role.

Some specific uses for the MAC addresses of switches include:

* terminating traffic to and from the switch itself
* determining the root bridge when using STP

I hope this has been helpful!

Laz

Hi Rene,
I understood ARP and Switching (I hope). Thank you for a very good explanation as always.
My question-- is it the host who always start the ARP process? Does a switch ever get chance to initiate ARP?

I believe there is a difference. Unknown is a case of unicast. In unicast the source and destination address are present and they are unique (I mean individual value). But in case of broadcast, it is intended for all hosts in the network (FF:FF:FF:FF:FF:FF).

Now the interesting thing is how the receivers will react to the unicast and broadcast. In case of unicast, only the host with a matching destination address will respond but rest will simply drop the packet. But in case of broadcast, there will be a reply from each of the receiving hosts to the source MAC. @andrew Please correct me if my understainding is not appropriate.

Hi Rosna,

Any device that has an IP address needs ARP. After all, if it wants to send an IP packet with a destination IP address, it has to figure out what the layer two MAC address is.

On a layer two switch, you still might want to configure an IP address. Here are some reasons:

- To manage it remotely through telnet or SSH.
- So it can send syslog messages to an external server.
- So you can use SNMP to monitor the switch.

It is possible that a switch is the initiator of the ARP process. For example, perhaps you just rebooted it and it wants to send syslog information to some syslog server…in that case, it will send an ARP request for the syslog server that you have configured on the switch.

Hope this helps!

Rene

1 Like

Rene, please check the link for the ARP lesson due it brings to me to the Course section.

Hello Juan.

Here’s the correct link to the lesson you’re looking for:

I’ll let Rene know about the broken link in his message…

I hope this has been helpful!

Laz