14

I have a relatively dumb question. Suppose the Switch just started, and it received a frame that contains a destination MAC address for a network device not in its MAC addresses table.

What happens then? Does it broadcast (MAC address ff:ff:ff:ff:ff:ff) and receive answers from connected devices, or is there a protocol dedicated for that which is used? I don't think the switch uses the ARP (Address Resolution Protocol)?

Improve this question
2
  • 1
    If you think about it, when a switch can't actually switch a frame (because it doesn't have the neccesary address in its table, for example), then it usually has to treat that frame as a hub would for compatibility reasons.
    – Todd Wilcox
    Apr 5, 2016 at 18:53
  • Really thanks to everyone for the answers.
    – user30817
    Sep 27, 2016 at 11:01

3 Answers 3

Reset to default
34

Good question. I'll answer it with an animation:

enter image description here

When Host A sends the frame, the switch does not have anything in its MAC address table. Upon receiving the frame, it records Host A's MAC Address to Switch Port mapping. Since it doesn't know where the destination MAC address is, it floods the frame out all ports.

This assures that if host B exists (which at this point, the switch does not know yet), that it will receive it. Hopefully, upon receiving the frame, Host B will generate a response frame, which will allow the Switch to learn the MAC address mapping from the return frame.

You can read more about how a Switch works here (where I took the animation from). I would also suggest reading the entire article series for a closer look at how a packet moves through a network.

One last note regarding the terms Flooding vs Broadcast. A switch never broadcasts frames, a broadcast is not an action a switch can take. A switch can only flood a frame. A broadcast is simply a frame with a destination MAC address of ffff.ffff.ffff. This is often confused because the end effect is the same, but they are actually different.

Improve this answer
4
  • The main difference between flooding and broadcasting is how the next node(s) will react
    – Ferrybig
    Apr 5, 2016 at 20:47
  • 2
    @Ferrybig Correct. But I would phrase it slightly different...The main difference between a switch flooding a unicast frame, and a switch flooding a broadcast frame is how the next node(s) will react. There is no such thing as a switch broadcasting a frame. (This comment, and my answer, is speaking of transit traffic, not management traffic to/from the switch)
    – Eddie
    Apr 5, 2016 at 21:16
  • Related question: if the switch just floods the frame when it doesn't know which port it should forward it to, isn't this a potential information security issue if the message that A was sending to B was confidential? Surely C could eavesdrop on that frame even though it knows it's not addressed to it?
    – Anakhand
    Mar 8, 2021 at 13:49
  • 1
    @Anakhand Yes. Absolutely. That is why nothing confidential should be sent on a wire that isn't also protected with Cryptography (SSL/TLS/IPsec, etc). In a way, you also don't have any assurance that whoever is running the switch isn't also capturing all the data flowing through it.
    – Eddie
    Mar 9, 2021 at 19:34
7

The switch doesn't use ARP, but ARP can help in preventing this situation from occurring in the first place, for two reasons:

  1. If node A is sending an IP packet to node B which isn't in its ARP cache, it will first send an ARP request (which is a broadcast packet, and will automatically be flooded to all ports by the switch). When node B sends its ARP reply, the switch will learn its MAC address. So, by the time actual data transfer happens, the switch already knows the MAC addresses of the participants, and doesn't need to flood data packets.

  2. Many devices, when their link goes up, will send a gratuitous ARP packet. In addition to updating the ARP caches of other nodes on the network, the GARP will also fill the switch's MAC address table.

IPv6 doesn't use ARP, but NDP fulfills a similar purpose.

So overall, although switches certainly will flood frames to unicast addresses they haven't learned, it's not necessary as often as you might think, because it will usually have the opportunity to learn nodes' addresses from broadcast frames beforehand. However, you can definitely observe it with a switch that's had its MAC table overflowed or that has just rebooted.

Improve this answer
4

When a switch receives a frame, it updates its MAC address table with the source MAC address and the port on which it received the frame. If the destination MAC address isn't in its MAC address table (unknown unicast), it floods the frame to all ports, except the port on which the frame was received.

Improve this answer
6
  • Except when it floods, it does not flood the frame back to the port from which it received the frame, right?
    – Todd Wilcox
    Apr 5, 2016 at 18:44
  • 1
    Right. it doesn't send it to the port from which the frame was received.
    – Ron Maupin ♦
    Apr 5, 2016 at 18:45
  • 3
    I'll just add that the switch doesn't learn the new (destination) MAC address until the device replies.
    – Ron Trunk
    Apr 5, 2016 at 18:47
  • By flooding the frame to all the ports, there is security risk?
    – user24308
    Apr 5, 2016 at 18:51
  • 3
    It can be. And that's why some/many switches support disabling unicast flooding of unknown unicast (as well as multicast.) In three decades of networking, I've never had the need to use it.
    – Ricky
    Apr 5, 2016 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.