I understand that a switch will broadcast to all ports if it doesn't have the destined destination in its mac address table but when I analysed a scenario in wireshark I got confused at what happened.
4 PC's connected to a switch. All of them had Wireshark running. PC 1 pinged PC 3.
When looking at each of the wiresharks:
PC 1 (which pinged PC 3) showed multiple ping request and reply between PC 1 and PC 3, but it also showed ARP - one asking who had the IP address belonging to PC 3, and the other asking who had the IP address belonging to PC 1.
PC 2 showed only 1 ping request for PC 3 and 1 ping reply for PC 1.
PC 3 showed multiple ping request and replies between PC 2 and PC 3 and the ARP request which was shown in PC 1.
PC 4 showed exactly the same as PC 2, only 1 ping request for PC 3 and 1 ping reply for PC 1.
How come PC 2 and PC 4 only had 1 ping request and reply? Is this from the switch not knowing about the addresses to begin with? And how come they don't receive the ARP broadcast, surely if it was because the switch didn't know the addresses shouldn't they have received the ARP broadcast?