Describe switching concepts

Section 1.1.b introduced the switch as the Layer 2 device that forwards frames by MAC address. This objective asks exactly how it does that. There are only four ideas, and they fit together into one simple algorithm that every switch runs on every frame.

1.13.a MAC learning and aging

A switch begins life knowing nothing about which device is on which port. It learns by inspecting the source MAC address of every frame it receives. When a frame arrives on port Gi0/1 with source MAC 0050.56be.1a2b, the switch records “MAC 0050.56be.1a2b is reachable via Gi0/1, in VLAN 10” in its MAC address table. It does this for every frame, in hardware, whether or not it forwards the frame anywhere. This is called MAC learning, and it is entirely passive: hosts do not register themselves, and no protocol is needed. Simply sending a frame (a DHCP request, an ARP, anything) is enough to be learned.

Learned entries are dynamic and have a timer. Each time a frame from that MAC arrives on that port, the timer is reset. If no frame is seen for the aging time, which is 300 seconds (5 minutes) by default on Cisco switches, the entry is removed. Aging keeps the table accurate when devices are moved or unplugged and prevents the table from filling with stale entries. If a MAC is later seen on a different port (a laptop moved from one wall jack to another), the switch simply updates the entry to the new port immediately.

! Change the aging time (seconds); 0 disables aging
SW1(config)# mac address-table aging-time 600
! Add a permanent (static) entry that never ages out
SW1(config)# mac address-table static 0050.56be.1a2b vlan 10 interface gi0/1

1.13.b Frame switching

Once the table is populated, the switch uses it for forwarding decisions. For each incoming frame, the switch reads the destination MAC and looks it up in the table, restricted to the frame’s VLAN:

• If the destination MAC is found and its port is different from the port the frame arrived on, the switch forwards the frame out only that one port. This is the normal case and is what makes a switch better than a hub: other ports never see traffic that is not meant for them.
• If the destination MAC is found and its port is the same port the frame arrived on, the switch filters (drops) the frame. This happens when a hub or another switch is attached to the port and two devices behind it are talking to each other; the frame has already reached its destination and does not need to be repeated.
• If the destination MAC is not found, the switch floods (next section).

Cisco switches also choose when to forward a frame relative to receiving it. Store-and-forward switching receives the entire frame, verifies the FCS, and only then forwards it; this is the method on all modern Catalyst switches and means corrupted frames are never propagated. Cut-through switching begins forwarding as soon as the destination MAC (the first 6 bytes after the preamble) has been read, minimizing latency at the cost of forwarding frames that may turn out to have bad FCS; fragment-free is a compromise that waits for the first 64 bytes so that collision fragments are dropped. Cut-through is used in some low-latency data center switches (Nexus).

1.13.c Frame flooding

Flooding means sending a copy of a frame out every port in the same VLAN except the port it arrived on. A switch floods in three cases:

1. Unknown unicast: the destination MAC is a unicast address that is not in the MAC address table. The switch has no idea where the host is, so it sends the frame everywhere in the VLAN and lets the correct host pick it up. When that host replies, its source MAC is learned and future frames are forwarded directly. Unknown unicast flooding is why the very first frames to a new host go everywhere and why a full MAC table is desirable.
2. Broadcast: the destination is ffff.ffff.ffff. By definition every host should receive it, so the switch floods it. ARP requests and DHCP Discover messages are broadcasts. Broadcasts define the broadcast domain: every port in the VLAN receives them, and only a router (or Layer 3 boundary) stops them.
3. Multicast: unless the switch is running IGMP snooping to learn which ports want a given group, multicast frames are treated like broadcasts and flooded within the VLAN.

Flooding is confined to the VLAN of the incoming frame. A broadcast on VLAN 10 never appears on a VLAN 20 port; that is precisely what VLANs are for (Domain 2).

1.13.d MAC address table

The MAC address table is the data structure that stores everything learned. It is also called the CAM table (Content Addressable Memory, after the special hardware memory that can look up an entry in a single clock cycle), the switching table, or the bridge table. Each entry contains the VLAN, the MAC address, the type (DYNAMIC, STATIC, or system), and the port. The table has a finite size (from a few thousand entries on small switches to tens of thousands on larger ones), which is why a MAC flooding attack, which fills the table with bogus addresses so that all traffic is flooded, is a real threat that port security (Domain 5) mitigates.

SW1# show mac address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 All    0100.0ccc.cccc    STATIC      CPU
 All    0180.c200.0000    STATIC      CPU
  10    0050.56be.1a2b    DYNAMIC     Gi0/1
  10    0050.56be.3c4d    DYNAMIC     Gi0/2
  10    0019.e8a1.0c00    DYNAMIC     Gi0/24
  20    3c22.fb12.3456    DYNAMIC     Gi0/5
  20    0019.e8a1.0c00    DYNAMIC     Gi0/24
Total Mac Addresses for this criterion: 7

Reading it: the STATIC entries pointing to CPU are the switch’s own reserved addresses (0100.0ccc.cccc is the CDP/VTP/PAgP multicast; 0180.c200.0000 is the STP BPDU address). Gi0/24 appears twice with the same MAC in two VLANs: that is a trunk to another switch (or a router), whose single MAC has been learned in each VLAN separately. Gi0/1, Gi0/2, and Gi0/5 each have one dynamic entry, the typical pattern of an access port with one host.

Useful variations of the command:

On older IOS versions the command is spelled show mac-address-table with a hyphen; both forms are accepted on many switches.

A complete troubleshooting workflow: a PC cannot reach its gateway. Run show mac address-table address <PC MAC> on the access switch to confirm the switch has learned the PC on the expected port and VLAN. If it has not, the PC is not sending anything (cable, NIC, or port shut down), or it is in the wrong VLAN. Then check the gateway’s MAC is learned on the uplink in the same VLAN. If both are present in the same VLAN, Layer 2 is fine and the problem is at Layer 3.