1

I know a layer 2 switch floods the frame out asking who has a certain mac address. My question is how does it know what mac address to ask for in the first place? Scenario: A brand new switch is implemented. 5 Hosts a re connected. Host A sends a message to Host B. How does A know what the mac address is of Host B in the first place?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 15, 2017 at 3:58

1 Answer 1

Reset to default
2

ARP (Address Resolution Protocol) is used by a source host to resolve the layer-3 address of a destination host to that host's layer-2 address. An ARP request is broadcast on layer-2, asking, "Who has this layer-3 address?" The host with that layer-3 address will unicast back to the requesting host with its layer-2 address.

Hosts populate an ARP cache with layer-3 addresses which have been resolved to layer-2 addresses so that ARP is only used the first time a host wants to send something to another host. Entries in a host's ARP cache have a timeout, and they will be eventually be flushed if there is no activity for that entry.

A switch only floods an unknown unicast, and switches don't ask who has a certain MAC address. A switch will maintain a MAC address table, which relates a particular MAC address to a switch interface. A switch builds or updates this table every time a frame enters a switch interface. The switch will look at the layer-2 source address on a frame entering an interface, and it will add to, or update, its MAC address table with that address and interface.

A switch will also look in its MAC address table for the layer-2 destination address in the frame to find to which interface the frame should be switched. Only if the switch doesn't find the destination address in its MAC address table does it flood the frame to all other interfaces. Entries in a switch MAC address table have a timeout, and they will eventually be flushed if there is no activity for the MAC address.

Improve this answer
5
  • 2
    Ron is 100% correct, ARP connects the "dots" for the MAC address table of the switch. When not known what device sits on a an interface and the switch needs to locate this data FF-FF-FF-FF-FF-FF is sent out of all interfaces on the switch. Hosts then send an arp reply message if is the owner of the mac address, hosts with no match do not reply. The arp reply arrives at the switch,the switch then documents which interface it was received upon in the MAC table. By this method once a MAC address is known a multicast ARP is not necessary for the device in question. SW1>>GE-0/1/1=01:54:1F:A5:FF:05
    – Ty Smith
    Sep 27, 2016 at 18:05
  • 1
    Well written answer, but perhaps A switch only floods an unknown unicast should perhaps also mention multicast and broadcast? @TySmith you seem to imply (not sure if it was intentional) that the switch sends FF-FF-FF-FF-FF-FF but this is wrong, as Ron wrote it is the host that sends and ARP request (with destination mac address FF-FF-FF-FF-FF which is the broadcast address and so this is indeed flooded out all ports). And so at the end where you mention "multicast arp", I suppose you meant broadcast??
    – hertitu
    Sep 28, 2016 at 21:15
  • The term "flood" is used for unicast frames to distinguish it from broadcast/multicast frames. A host only floods unknown unicast frames. It will broadcast broadcast frames. and depending on IGMP snooping, it may only send multicasts to interfaces which have requested to be members of the multicast group, or it may broadcast those, too.
    – Ron Maupin ♦
    Sep 28, 2016 at 21:20
  • 1
    It seems we have a different opinion on the definition of flooding then, but I guess this becomes more of a semantic discussion. IMHO (and a quick google search seems to reveal that some people agree with you and others agree with me) flooding is a generic term for sending a frame or packet (can be L2 or L3) out on all ports except the ingress port, and can be used (at L2) for unknown unicast, multicast (without igmp snooping) and broadcast. Broadcasting (at L2) is the act of sending a frame to FFFF:FFFF:FFFF. In other words a host broadcasts (e.g.) an ARP request on the LAN...
    – hertitu
    Sep 29, 2016 at 9:22
  • 1
    ... and as part of this broadcast process the switch floods that frame. FWIW Cisco seems to refer to "unknown multicast flooding" but not to "broadcast flooding" as far as I could tell from a quick search, so they seem to be somewhat in the middle :) BTW I don't mean to be pedantic about this, as I said I think this is a matter of opinion about semantics, I just think it may be worth considering a minor edit to your answer because some readers might get confused by A switch only floods an unknown unicast because the world seems to use different definitions of flooding.
    – hertitu
    Sep 29, 2016 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.