When/Why would a switch filter/discard a frame?

When/Why would a switch filter/discard a frame instead of simply flooding it?

Switches flood frames destined for MAC addresses it doesn't recognize.
Switches forward frames to the appropriate interface for known MAC addresses.

However, I read that switches sometimes discard/filter frames. When/Why would it do this?

The only thing I can think of is if a hub is connected to a switchport with multiple end-devices on the hub. When the devices try to talk to each other, the switchport gets each and every frame. Does it discard frames from those devices trying to talk to each other since they are on the same int? (Discarding frames w/ destination address of the same int it's coming from.)

Is that somewhat correct?

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

networker050184

Quite a few reasons. QoS, ACLs, bad checksum etc.

Dieg0M

Why Frames and Bytes Are Discarded - Cisco Systems

networker050184

That is for IGX/BPX (Frame/ATM switches). Not ethernet switches.

DoubleNNs

Other than ACLs and QoS, I guess I forgot checksums.

Another question: if you connect a hub to a switchport, how does the switch make sense of the multiple MAC addresses going to the int? Can it keep track of multiple MAC addresses for a single int in it's CAM table?
Since hubs are L1 devices, they can't replace the source MAC addresses, can they?

networker050184

Yes it can keep track of more than one MAC per interface. How else would you be able to connect two switches together? If the source and destination are the same interface that is another scenario the frame will be dropped.

AwesomeGarrett

Yes, you got it! The switch will just keep track of the MAC addresses learn from a particular interface in the CAM table. I forget what the default max entries are but now I'm gonna go research it out of my own curiosity.

EDIT: Ok, so there is not default max entries and it just depends on the platform in question. You can use the show mac-address-table count command to view the total MAC address space. In order to conserve CAM table space by default CAM table entries are for 300 seconds.

DoubleNNs

Thanks a bunch.

It's always great to get a better grasp on the basics. And also learn to connect different concepts together.