Is an Ethernet Packet sent to all the hosts on a network, and then all of them discard the packet except the right host to which the packet was sent to? This page here says:

Local networks like an Ethernet network sends all traffic to all computers that sits on the same network bus.

Does this mean that anyone can intercept information meant for anyone else by just feigning to be the right receiver?

  • You have some very old material. Ethernet on a bus hasn't been used in many, many years. Ethernet on UTP connected to switches, or on fiber is the new normal. – Ron Maupin Sep 7 '16 at 1:30
  • @RonMaupin Regardless of that, is it still true? What is the norm now? Send data to all or send data to specific? – Kraken Sep 7 '16 at 1:33

The answer depends on the type of Ethernet network you have. In modern, switched networks, the switch forwards packets only to the destination host, based on the MAC address.

In (much) older networks that use Ethernet hubs, packets are received by all hosts. Since every host receives the packet, that means only one host can transmit at a time -- a big disadvantage over switched networks.

Moreover, switched Ethernet networks are full duplex, meaning hosts can receive and transmit at the same time. Hub-based networks are half-duplex, meaning hosts can receive or transmit, but not at the same time.

  • switch forwards packets only to the destination host, based on the MAC address and when the switch does not know on which port the destination MAC lives - or when the destination is the broadcast address - then it will broadcast the frame on all ports (except the one the frame arrived on). – hertitu Sep 7 '16 at 7:37
  • What about our local networks? If two machines want to communicate on a WLAN, there is no switch between them, right. – Kraken Sep 7 '16 at 10:08
  • 1
    Right. Wireless acts more like a hub. But wireless is not Ethernet. Wifi uses different methods for media access (CSMA/CA) and is half duplex. – Ron Trunk Sep 7 '16 at 11:00
  • WiFi uses air to convey data, which is a shared medium, as used to be bus networks. 802.3 ain't 802.11 ;) In WiFi, stations can't detect collisions. // @hertitu not really, in this case, ARP is used. The station which doesn't know the MAC address/IP address correspondance (be it a switch or a terminal) sends a broadcasted ARP request asking "who is <IP address>". Then either the station is in the broadcast domain and responds with its MAC address, either it is not and no answer is sent back. // If the data frame was broadcasted, imagine the network state... – Doezer Sep 7 '16 at 11:49
  • @Doezer: a host does ARP, yes (but that is not what I was talking about). A switch (at least the kind that I've been working with for the past 15 years) does not do ARP (except for management traffic to/from the switch of course but then it really acts as a host). See en.wikipedia.org/wiki/Unicast_flood – hertitu Sep 7 '16 at 12:29

If the destination link layer address (MAC Address) is not known to the switch then it is forwarded out all ports and gets to every connected host. Once a host responds, the switch remembers where that host is (which port) and forwards frames addressed to that particular host (MAC Address) only out of that particular port.

However, a switches MAC address table can become overloaded in which case the switch reverts to hub like behavior, forwarding each frame out of every port. See MAC Flooding.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.