30

Say the switch table is empty. If computer A sends a frame destined to computer B, the switch will broadcast asking who has the MAC address of B. What if C suddenly sends a frame to A? What is the mechanism so the switch doesn't mistakenly think computer C is computer B? Is it that it remembers the MAC address of the destination desired by computer A, and when C tries to get to A it also contains its own MAC address and the switch sees it isn't the same destination as computer A wanted?

Basically I'm asking, when a switch floods for an unknown MAC address for a request sent by host A, how does it know that the destination is responding to host A or if some other host just happens to be transmitting to A?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Jan 3, 2021 at 1:31

4 Answers 4

Reset to default
50

Layer 2 switches (bridges) have a MAC address table that contains a MAC address and physical port number. Switches follow this simple algorithm for forwarding frames:

  1. When a frame is received, the switch compares the SOURCE MAC address to the MAC address table. If the SOURCE is unknown, the switch adds it to the table along with the physical port number the frame was received on. In this way, the switch learns the MAC address and physical connection port of every transmitting device.

  2. The switch then compares the DESTINATION MAC address with the table. If there is an entry, the switch forwards the frame out the associated physical port. If there is no entry, the switch sends the frame out all its physical ports, except the physical port that the frame was received on (Flooding). If the DESTINATION is on the same port as the SOURCE (if they're both on the same segment), the switch will not forward the frame.)

Note that the switch does not learn the destination MAC until it receives a frame from that device.

Improve this answer
8
  • Thank you @Ron for explaining it better. Now I know flooding is. The can also be found at en.wikipedia.org/wiki/Unicast_flood
    – Damon
    Nov 14, 2014 at 15:31
  • This didn't answer the question I had asked.
    – Celeritas
    Nov 14, 2014 at 22:37
  • 7
    @Celeritas Your assumption in your question is wrong. The switch doesn't "ask" who has a mac address. If it doesn't know the destination MAC, it floods the frame out all ports. It only learns source MACs when it receives a frame. So in your question, the switch can tell the difference between B and C because they have different source MAC addresses.
    – Ron Trunk
    Nov 14, 2014 at 22:44
  • 6
    @Celeritas - The switch neither knows, nor cares, why any host is sending something to Host A. Why would it matter if a host is responding to Host A, or another host is sending something else to Host A? The switch only cares that the destination MAC is for Host A (and what the source MAC is if it isn't in the MAC address table). Only Host A cares if the received frame is a response from the host to which is originally sent a frame.
    – Ron Maupin ♦
    Nov 14, 2014 at 22:47
  • What Ron said, this concept is separate from ARP.
    – Jordan Head
    Nov 14, 2014 at 22:54
5

Your question presumes that the switch is involved in, or is aware of, the communication/conversation between two hosts (Is this a conversation between A and B or between A and C?). The switch isn't involved in the communication/conversation between two hosts. It simply knows (or learns) which MAC address is associated with which port and forwards (or switches) traffic destined for a particular MAC address to the associated port (once it has learned which port is associated with the MAC address), regardless of whether the source is B, or C or any other host connected to any other switch port.

Switches work at layer 2. Session management is the responsibility of higher layers.

Improve this answer
-2

First thing every host (host A and B here) has their routing table and arp cache table.

When host A tries to reach host B , host A will see it's routing table first to look for which interface it should send traffic out. Assume host B is in the same network as host A here.

We already know host B IP , now after routing table host A will see arp cache to see if it has host B MAC address already cached or not. In this case we suppose its not there.

Now, what host A will do it will fill ethernet frame(layer 2) destination MAC as something like FF:FF:FF:FF:FF:FF:FF (which means broadcast aka ARP). ARP(Address Resolution Protocol) is layer 2 protocol. Remember till now layer 3 protocol type (Internet Protocol) is not applied or we can say its padded.

ARP packet contains following fields (you can also see this from wireshark pcaps just filter it out for arp):

Destination MAC: FF:FF:FF:FF:FF:FF:FF --> In pcaps you will see it like "Broadcast" inside wireshark Destination IP: host B Source MAC : host A Source IP : host A

Of-coure source IP and destination IP are coming from layer 3 only here but no layer 3 protocol is in use till now as connection between host A and B not established yet. Once connection will be established then only any layer 3 protocol will be in use.

Here , how switch will learn about host A MAC address for the first time and it will update this in its MAC table if it dont have entry for it earlier.

Now, Once switch sees Ethernet frame destination MAC as broadcast(ARP), it will send ARP request to every host within that network. Remember as ARP is layer 2 protocol it will not be routable to other networks other than it is sent from i.e network of host A here.

Till now ARP will reach out to every host within that network, asking who-so ever has please tell your MAC address to host A. Once ARP reply is received from host B as destination IP is of host B in ARP packet, only host B will respond other will simply discard it,

Here, switch and host A both will update their MAC table and arp cache table respectively for host B's MAC address.

This is how Switch learn its MAC table.

Now, coming to if host C also tries to reach out host A. Same process will follow and only host C will respond with its MAC address others will discard as destination IP will be of host C only inside ARP packet. Assuming neither switch nor host A has MAC info available or we can say host A --> B and host C --> A took place at same time.

Improve this answer
6
  • 2
    You're answering a different question than what was asked. You're explaining how address resolutions works, but the OP is simply asking about MAC addresses and switching.
    – Ron Trunk
    Dec 8, 2021 at 19:56
  • 1
    "First thing every host has their local routing table and arp cache." ARP has nothing to do with a switch table. ARP relates a MAC address to a given IPv4 address (IPv6 does not use ARP), but a switch has no idea about IP addresses. A switch table relates a switch interface for a given MAC address. ARP tables and switch tables are two very different things.
    – Ron Maupin ♦
    Dec 8, 2021 at 19:59
  • Here I have tried to explain mechanism how switch learn its MAC table assuming communication happening for first time in the network and switch MAC table is empty. I tried my best to explain procedure keeping in mind scenerio in question.
    – Neeraj pal
    Dec 10, 2021 at 12:24
  • 1
    MAC address learning has nothing to do with ARP. It works just as well with protocols other than IPv4. Other layer-3 protocols, such as IPv6, IPX, AppleTalk, etc., do not use ARP, but switches still populate their MAC address tables.
    – Ron Maupin ♦
    Dec 10, 2021 at 13:20
  • 1
    We'll say it again: switches do not have ARP tables, nor participate in the ARP protocol.
    – Ron Trunk
    Dec 10, 2021 at 13:26
-3

Its not called switch table ; its MAC table. Now consider that MAC table is empty. When A tries to send a packet to B; the packet contains the MAC address of A and B. The switch updates MAC address of A in MAC table. Now since it doesn't know the port to which B is connected, so it broadcasts ARP packet at all of its ports and waits for all hosts to reply.

Now at the same time if C tries to send a packet to A, It extracts the MAC address of C from that packet and stores it in MAC table. Now since the MAC address of is already present in MAC table, so it knows to which port A is connected. Remember Data packets contains MAC address of both source and destination. Hence the MAC address of B & C are different. So the switch does not get confused. Now switch forwards the packet from C to A (Given that both are present in same VLAN).

To send the packet from A to B, it waits till B responds to ARP packet sent by switch. When it receives response from B, it updates the MAC address of B in its MAC table. Then finally the packet is forwarded to B.

Hence the switch does not get confused as the data packets (tcp/udp) contains both source and destination MAC address. And your switch won't forward a packet on an interface whose end host MAC address is not known to switch. It has to wait till the end host replies to ARP broadcast sent by switch.

Improve this answer
5
  • 1
    This is not entirely accurate. A switch, unless it is a layer-3 switch, doesn't ARP. ARP is to resolve between layer-2 and layer-3, and the switch doesn't know layer-3. The switch does, indeed, broadcast a frame with an unknown destination MAC to every switch port. A host will ignore any frame with a destination MAC not its own.
    – Ron Maupin ♦
    Nov 14, 2014 at 13:19
  • 1
    And a slight clarification to Ron's clarification...mostly just terminology correction. When a switch sends a packet out to every port (except the ingress port) because it doesn't know where that particularly MAC address is located, its generally called "flooding".
    – Jeff McAdams
    Nov 14, 2014 at 14:42
  • @Ron thank you for your correction. A forgot to write that this is for layer 3 switch. And I also was like to admit that I forgot the term flooding, so I wrote the reply for layer 3 switches. And Jeff thank you for telling.
    – Damon
    Nov 14, 2014 at 14:53
  • @Jeff McAdams, You are correct, it is flood, thank you. It was before my first cup of coffee after I got up early, and I meant broadcast in the language sense, not the network sense.
    – Ron Maupin ♦
    Nov 14, 2014 at 22:20
  • @Damon, that's what I didn't know is that every frame contains the source and destination MAC address.
    – Celeritas
    Nov 15, 2014 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.