0

I understand that a switch will broadcast to all ports if it doesn't have the destined destination in its mac address table but when I analysed a scenario in wireshark I got confused at what happened.

Scenario:

4 PC's connected to a switch. All of them had Wireshark running. PC 1 pinged PC 3.

When looking at each of the wiresharks:

PC 1 (which pinged PC 3) showed multiple ping request and reply between PC 1 and PC 3, but it also showed ARP - one asking who had the IP address belonging to PC 3, and the other asking who had the IP address belonging to PC 1.

PC 2 showed only 1 ping request for PC 3 and 1 ping reply for PC 1.

PC 3 showed multiple ping request and replies between PC 2 and PC 3 and the ARP request which was shown in PC 1.

PC 4 showed exactly the same as PC 2, only 1 ping request for PC 3 and 1 ping reply for PC 1.

How come PC 2 and PC 4 only had 1 ping request and reply? Is this from the switch not knowing about the addresses to begin with? And how come they don't receive the ARP broadcast, surely if it was because the switch didn't know the addresses shouldn't they have received the ARP broadcast?

enter image description here

Results for PC 1 and 3

Results for PC 2 and 4

  • Your understanding is correct, and the results are a bit strange. Ignoring the ping for a moment, the ARP request has a broadcast destination and is required to go out of all ports of the switch (except the port it arrived on). The ARP reply is unicast and shouldn't normally be seen except by sender and recipient. Is it possible your captures were not as broad as you expected? – jonathanjo Mar 11 at 22:37
  • "I understand that a switch will broadcast to all ports if it doesn't have the destined destination in its mac address table..." That is incorrect. A switch will flood frames with an unknown unicast address to all the other interfaces, except the one on which the frame arrived. Broadcast uses the broadcast address as the destination address on a frame, and a switch will not change the unicast destination address into a broadcast address. Switches are transparent devices; the delivered frame is the same as received. – Ron Maupin Mar 11 at 22:38
  • Without more information, all we can do is speculate or guess, which is off-topic here. You should give us a diagram, the switch model, the switch configuration, and the actual Wireshark results. – Ron Maupin Mar 11 at 22:39
  • I've added a diagram and 2 screenshots, first screenshot is pc 2 and the results are the same for pc 4, the second screenshot is pc 1 and the results are the same for pc 3 – The_Bear Mar 11 at 23:27
  • What are the IP addresses of the 4 machines? You ping PC3 from PC1 but the capture show IP addresses 2 and 3. – JFL Mar 12 at 11:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.