2

I want to know what is the mechanism behind a switch, so that it understands which of its ports are connected to a host (end device), and which of them are connected to another switch?

Imagine trunk and access links, but in my case I am not using a VLAN, I just need the information.

Improve this question

2 Answers 2

Reset to default
7

A switch simply record the source MAC addresses of frames ingressing on a given port. It doesn't care if there's a single host, or another switch connected on a port (for that purpose).

If a single host is connected, there will be only the MAC address of this host recorded for this port.

If it is a switch, then potentially there will be traffic from all hosts connected to this switch on this port and the switch will learn the MAC addresses of all those hosts.

So if you find a large number of MAC addresses associated with a port, it is likely a port connected to another switch (or to an hypervisor which embed a virtual switch).

Improve this answer
4
  • There is a one-to-one correspondence between hosts and ports in the access link right? I mean if a port is assigned only one MAC address, it may be a host or a switch, but if "more than one" MAC addresses are assigned to a port, it is "definitely" connected to a virtual or physical switch?
    – Ninja Bug
    Commented Sep 24, 2018 at 10:05
  • @NinjaBug Right. It can also be a hub of course (increasingly rare) or a WiFi access point - which is functionally equivalent to a switch.
    – JFL
    Commented Sep 24, 2018 at 10:11
  • Or a computer replying to more than one MAC address for some reason.
    – Henrik supports the community
    Commented Sep 24, 2018 at 12:40
  • a) Host replying to more than one MAC address could be a router with HSRP or similar; b) Swapping hosts on an interface might not clear the MAC address table entry (depends on medium), the cache timeout is normally short (~10 sec) but can be long (first router I tried allowed 1 million seconds, approx 11.6 days).
    – jonathanjo
    Commented Sep 24, 2018 at 13:03
1

It is common that switches (and other equipment such as routers, bridges, access points) run link-layer protocols to advertise themselves. It's not universal that switches have the capability (normally it's only the more managable models) and certainly it's not universal that it's enabled. It's rare for it to be enabled across links to other organisations.

  • LLDP (Link Layer Discovery Protocol) is the multi-vendor one, defined by IEEE as 802.1AB
  • CDP (Cisco Discovery Protocol) is a very common proprietary one

In the simplest description, they send frames to special MAC addresses indicating their presence and details, but never forward those frames.

A Cisco router might show:

R1#show cdp neighbors 
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone, 
                  D - Remote, C - CVTA, M - Two-port Mac Relay 

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
c8f9f9123456     Fas 3              131             S I   SG 300-28 gi12
ap2.example.com  Fas 1              140              T    AIR-AP123 Fas 0

It's also possible to query the neighbour list by SNMP.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.