Switch Learning

Okay lets say i have PC-A connected to interface 1 on a Switch and PC-B connected to Interface 2, PC-C connected to Interface 3 and PC-D connected to Interface 4. The switch doesnt know about PC-B yet on it's CAM Table but it does know PC-A.

So PC-A wants to send a message to PC-B but since the Switch doesnt recognize PC-B yet in it's CAM table so it has to perform a Broadcast to all the other interfaces to ensure PC-B receives the message. Since an ethernet frame only consists of a SOURCE MAC and a DESTINATION MAC - How can PC-B know that PC-A is wanting to speak to just him so that PC-B can respond back to PC-A?

So the frame would have the SOURCE MAC of PC-A and the DESTINATION would be just a BROADCAST right? Or would it have a SOURCE, Destination , AND Broadcast? someone clear this up? cuz from what i've read, there can only be 2 addresses on the frame.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

kalebksp

The switch doesn't send a broadcast in the sense that the destination MAC is changed to all f's. It sends the unmodified frame out all ports (except the one it came in, of course).

dynamik

This process is referred to as flooding the frames, and they are unicast frames sent out all interfaces, not broadcasts.

edit: too slow...

DerekAustin26

Oh i thought Flooding and Broadcasting were the same thing..

jmc012

DerekAustin26 wrote: »

Oh i thought Flooding and Broadcasting were the same thing..

Host A would send an ARP request with it's source MAC and IP and the destination MAC of FF-FF-FF-FF-FF-FF "the broadcast address" and the destination IP of host B.

Correct certified guys??

Jim

kalebksp

jmc012 wrote: »

Host A would send an ARP request with it's source MAC and IP and the destination MAC of FF-FF-FF-FF-FF-FF "the broadcast address" and the destination IP of host B.

That is how ARP works, but ARP requests are not the only situation where broadcast is used.

captobvious

What kalebksp and dynamik posted is correct.

Switches forward the unknown unicast frames(frames whose destination MAC addresses are not yet in the address table) out all other interfaces, with the hope that the unknown device will be on some other Ethernet segment and will reply, allowing the switch to build a correct data entry in the address table.

jmc012

captobvious wrote: »

What kalebksp and dynamik posted is correct.

Switches forward the unknown unicast frames(frames whose destination MAC addresses are not yet in the address table) out all other interfaces, with the hope that the unknown device will be on some other Ethernet segment and will reply, allowing the switch to build a correct data entry in the address table.

I was sure they were correct I just didn't remember reading that. I went back and re-read odoms chapter on switching and found that paragraph, guess I better review the whole chapter again.

DerekAustin26

so how would the destination (PC-B) know to respond back to the switch if all the other PC's are getting a broadcasts as well? The question i was asking is how will the Destination (PC-B) know to respond back to the source (PC-A) if it doesnt know that PC-A is specifically requesting a connection with it since all the other PC's are receiving the same message??

Do all the receiving Destination's respond back to the switch , where the switch forwards all the ACK's back to PC-A and then that way the Switch can then update the CAM table and then PC-A can then communicate with PC-B and the switch will the forward the unicast directly to PC-B?

drew2000

This one is tricky to explain in text.

When PC-B responds to the flood, the switch will then add the PC-B MAC address to it's table.

PC-B knows to respond to the MAC address of PC-A because it is in the frame (as the source MAC). So, since the switch already knows the MAC for PC-A, it will know where to deliver the response from PC-B.

Drew

kalebksp

DerekAustin26 wrote: »

so how would the destination (PC-B) know to respond back to the switch if all the other PC's are getting a broadcasts as well? The question i was asking is how will the Destination (PC-B) know to respond back to the source (PC-A) if it doesnt know that PC-A is specifically requesting a connection with it since all the other PC's are receiving the same message??

Do all the receiving Destination's respond back to the switch , where the switch forwards all the ACK's back to PC-A and then that way the Switch can then update the CAM table and then PC-A can then communicate with PC-B and the switch will the forward the unicast directly to PC-B?

What protocol are you referring to? What PC-B does with the packet after receiving it depends what the broadcast is for.

In the case of ARP PC-B will see that the destination IP address matches it own, so it will then reply with its MAC address.

DerekAustin26

Okay, so this isnt so much a "broadcast" as in "FFFF" it is a "FLOOD" of the "Unicast" which will have the Source and Destination (PC-B)?

dynamik

Correct.