Suppose PC1 with IP address and MAC address A.A.A.A wants to send a frame to PC2 with IP address and MAC address B.B.B.B, plus there is a switch in the middle. PC1 doesn't know where is PC2 located so it will send an ARP REQUEST.

Now, when the ARP reaches the switch, the switch makes the decision of flooding all the ports except the one it came from, and when it does that the request will reach PC2 which will first add the IP and MAC addresses of the SRC to its ARP table, and then it will REPLY with its IP and MAC addresses. After that the packet is sent.

Of course, the switch will direct the reply to PC1 because it knows its MAC address and IP address Of the SRC and DES.

Now, the BUM (Boradcast Unkown Unicast Multicast)

What I know is that (suppose having the same end points and switch) the switch uses this traffic to dynamically learn the which port belongs to which endpoint. Suppose the same case where PC1 wants to send a frame to PC2. PC1 frame has the SRC and DES IP and MAC addresses. The frame is sent, and when it reaches the switch, the switch looks into its CAM table to know which port belongs to which MAC address and if it doesn't find PC2 it will send the frame (WITH THE MAC AND IP ADDRESSES OF BOTH END POINTS) to all end devices and PC2 will know that this IP address belongs to him PC2 will reply and when it does. I think it sends back the same frame (I am not sure but it will send back something whether a frame or a request that will tell the switch to register that port with its IP and MAC addresses).

I have came to my own conclusion that says the ARP protocol helps in saving the IP and MAC addresses of other machines (PC2 in this case) in its own ARP table. On the other hand, the switch uses the BUM traffic to fill up its own CAM table. (please correct me if am wrong)

What I am asking here is:

  1. Is my explanation correct?

  2. What are the main differences between them?

  3. Can we use one of them only? because they seem to be doing the same task. If not why?

Please correct me if I got something wrong. I know whoever is going to answer me will have way way way more knowledge than me, so please share with me as much as you can because I have passion for what am trying to learn! :)

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Commented Feb 19, 2018 at 5:29

1 Answer 1


Switches operate at layer-2, e.g. ethernet, and they don't get involved with layer-3, e.g. IPv4, IPX, IPv6, AppleTalk, etc. This allows switches to switch traffic at layer-2 for any layer-3 protocol.

ARP is used by hosts to translate a layer-3 address to a layer-2 (MAC) address, so switches don't use ARP, nor are they even aware of the layer-3 addressing.

If a host doesn't have the layer-2 address for a particular layer-3 address in its ARP table, it will use ARP (broadcast) to discover the layer-2 address for that layer-3 address.

A switch has a MAC address table, not an ARP table like the hosts (except where it is a host for management purposes, but that has nothing to do with the switching function). While an ARP table can look up a layer-2 address from a layer-3 address, a switch MAC address table will look up a switch interface from a layer-2 address. Many people get this wrong.

If a switch doesn't have a layer-2 address in its MAC address table, then it will flood the frame to all interfaces, except the one where it entered the switch.

Switches will broadcast any frame with the broadcast layer-2 address to all switch interfaces, except the one where the frame entered the switch.

Multicast, at layer-2, where switches operate, is a form of broadcast, and multicast frames are treated like broadcasts. This has been mitigated by IGMP snooping in many new switches. This allows a switch to snoop on the IGMP requests by hosts to a multicast router. A switch with IGMP snooping enabled will learn and build a table of which interfaces have requested to join which IGMP groups, and it will only send traffic to those interfaces for that multicast group.

None of the switch behavior has anything to do with ARP or ARP tables in hosts.

  • so does that mean each IP that exist in the ARP table of any device should have a MAC Address associated with it at all times? and if it doesn't it will send an ARP request?
    – SaifYsn
    Commented Jul 12, 2017 at 3:16
  • I'm not sure I understand your premise. Devices do not need the MAC addresses of other hosts' IP addresses unless they need to send something to the other host. ARP tables are limited in size, and it makes no sense to maintain MAC addresses of other hosts to which a host is never going to send traffic. Also, as I tried to explain, a switch doesn't use ARP or know or care about IP addresses.
    – Ron Maupin
    Commented Jul 12, 2017 at 3:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.