Understanding MAC Learning

A switch operates on layer 2 of the OSI model which means that it processes frames and forwards them based on MAC addresses.

Switches Learn, Filter, Forward and Flood Ethernet frames.

Learning process:
A switch begins learning the local MAC addresses as soon as it is connected to other devices or to a network. This learning capability makes switches easy to use on a network.

 The switch learning process works like this:

1.As a PC or other networked device sends a frame to another device through the switch, the switch captures the source MAC address of the frame and the interface that received it.

2.The switch confirms or adds the MAC address and the port to the lookup table.

A switch also keeps a timer for each of the MAC address entries in its lookup table. By default, many vendors set this time to hold an address entry to 300 seconds (5 minutes). This can be changed if you want. The timer lets the switch get rid of old entries to keep the lookup process short and fast.

The aging timer also helps when a device moves to another switch port. In that case, the address would appear in both places in the lookup tables. When a frame arrives headed for that address, the switch can compare the aging timer for both entries and select the most recent if the entry has not already timed out.

ARP Request :

Most often, the initial communication to a switch is an Address Resolution Protocol (ARP) request. The inbound ARP contains the sender’s MAC address, and the switch adds that address to its lookup table. The ARP Response contains the MAC address of the intended target. The ARP response also updates the switch’s lookup table.


Learning Flooding:
What happens though when the switch receives a frame with a destination MAC address and it cannot find the same in the switch’s lookup table.As part of the learning process, a switch will flood the single frame out all of its other ports.This process is called unknown unicast flooding.

In the initial stage, the switch does not know any MAC addresses at all.Let’s assume that the switch receives for first time a frame from A destined to B. When the switch receives this frame from A, it will store the source MAC address (aaaa.aaaa.aaaa) and the port where the frame came from (fa0/1)  in its table . So the table will now contain one entry with the information of server A. However, since the switch does not find the address of B in its table, it will have to flood the frame to both ports fa0/2 and fa0/3, so both B and C will receive it:








Forwarding and Filtering processes:
When a switch has learned the locations of the devices connected to it, the switch is ready to either forward or filter frames based on the destination MAC address of the frame and the contents of the switch lookup table.

Let’s now assume that B wants to reply back to A, so the switch now receives a frame from B destined to A. First of all, the switch will store  the source MAC address of that frame (bbbb.bbbb.bbbb) and the port the frame came from (fa0/2) in its table as a new entry. In order to forward the frame, the switch will check if the destination MAC address exists in its address table. Since the address of A does exist in the table, the switch will forward the frame only to port fa0/1 (where A is located):

The switch filters out (or does not send the frame to) other ports on the switch since they do not have the target MAC address in the lookup table. That way, no one else can look at the contents of the frame.




The switch will learn and register in its table the MAC address of C, only when it receives a frame from C. After learning the addresses of all servers, the switch’s address table will look like the picture below:



Flooding process:
A switch also floods all of its other ports under two other circumstances:

  • If a broadcast frame is received with a destination MAC address ff ff ff ff ff ff, the switch forwards the broadcast frame out all of the other ports except VLANs.
  • If a multicast frame is received, the switch forwards the multicast frame (the first byte contains an odd value such as 01 00 50 00 00 09) out all the switch’s remaining ports. VLAN exceptions apply to flooding by limiting it to the same VLAN as the sender.
The flooding process for broadcast is necessary for protocols such as ARP which maps an IP address to a MAC address via broadcasting. One significant problem with this flooding process occurs when switches in a network are redundantly connected into physical loops. Flooding broadcast frames can cause a “broadcast storm” on a network, causing it to fail.

No comments:

Post a Comment