CCNA 200-301 Day 6

Ethernet LAN Switching (Part 2)

 Ethernet Frame

Eth. Eth.
header Packet trailer

Preamble SFD Destination Source Type FCS

7 1 6 6 2 4

●
The Preamble + SFD is usually not considered part of the
Ethernet header
●
Therefore the size of the Ethernet header + trailer is 18 bytes
(6 + 6 + 2 + 4)
 Ethernet Frame

Eth. Eth.
header Packet trailer

Preamble SFD Destination Source Type FCS

●
The minimum size for an Ethernet frame (Header + Payload
[Packet] + Trailer) is 64 bytes
●
64 bytes – 18 bytes (header + trailer size) = 46 bytes
●
Therefore the minimum payload (packet) size is 46 bytes
●
If the payload is less than 46 bytes, padding bytes are added
●
ie. 34-byte packet + 12-byte padding = 46 bytes
 Ethernet LAN Switching
MAC: 0C2F.B011.9D00 MAC: 0C2F.B06A.3900
192.168.1.0/24
PC1 G0/0 G0/0 PC3
.1
G0/2 G0/2 .3
.2 .4
PC2 G0/1 PC4
SW1 SW2 G0/1
MAC: 0C2F.B084.6200 MAC: 0C2F.B01E.0A00

SW1 MAC Address Table SW2 MAC Address Table

MAC Interface MAC Interface
 Ethernet LAN Switching
MAC: 0C2F.B011.9D00 MAC: 0C2F.B06A.3900
192.168.1.0/24
PC1 G0/0 G0/0 PC3
.1
G0/2 G0/2 .3
.2 ARP (Address resolution Protocol) .4
PC2 G0/1 PC4
SW1 SW2 G0/1
MAC: 0C2F.B084.6200 MAC: 0C2F.B01E.0A00

SW1 MAC Address Table Src IP: 192.168.1.1 SW2 MAC Address Table
Dst IP: 192.168.1.3 MAC Interface
MAC Interface
Src MAC: .9D00
Dst MAC: ???
 ARP

●
ARP stands for ‘Address Resolution Protocol’
●
ARP is used to discover the Layer 2 address (MAC address) of
a known Layer 3 address (IP address)
●
Consists of two messages:
ARP Request
ARP Reply
●
ARP Request is broadcast = sent to all hosts on the network
●
ARP Reply is unicast = sent only to one host (the host that
sent the request)
 ARP Request
MAC: 0C2F.B011.9D00 MAC: 0C2F.B06A.3900

ARP Req
192.168.1.0/24
PC1 G0/0 G0/0 PC3
.1
G0/2 G0/2FFFF.FFFF.FFFF.3
= broadcast MAC address
.2 .4
PC2 G0/1 PC4
SW1 SW2 G0/1
MAC: 0C2F.B084.6200 ARP REQUEST MAC: 0C2F.B01E.0A00
Src IP: 192.168.1.1
SW1 MAC Address Table Dst IP: 192.168.1.3 SW2 MAC Address Table
MAC Interface Src MAC: 0C2F.B011.9D00 MAC Interface
Dst MAC: FFFF.FFFF.FFFF

Src IP: 192.168.1.1

Dst IP: 192.168.1.3
Src MAC: .9D00
Dst MAC: ???
 ARP Request
MAC: 0C2F.B011.9D00 MAC: 0C2F.B06A.3900
192.168.1.0/24
PC1 G0/0 G0/0 PC3
.1
G0/2 G0/2 .3
ARP Req

x
.2 .4
PC2 ARP Req G0/1 PC4
SW1 SW2 G0/1
MAC: 0C2F.B084.6200 ARP REQUEST MAC: 0C2F.B01E.0A00
Src IP: 192.168.1.1
SW1 MAC Address Table Dst IP: 192.168.1.3 SW2 MAC Address Table
dynamic
Src MAC:MAC address
0C2F.B011.9D00
MAC Interface MAC Interface
Dst MAC: FFFF.FFFF.FFFF
.9D00 G0/0
Src IP: 192.168.1.1
Dst IP: 192.168.1.3
Src MAC: .9D00
Dst MAC: ???
 ARP Request
MAC: 0C2F.B011.9D00 MAC: 0C2F.B06A.3900
192.168.1.0/24
PC1 G0/0 G0/0 ARP Req PC3
.1
G0/2 G0/2 .3

x
.2 .4
G0/1
PC2 SW1 SW2 G0/1 ARP Req PC4
MAC: 0C2F.B084.6200 ARP REQUEST MAC: 0C2F.B01E.0A00
Src IP: 192.168.1.1
SW1 MAC Address Table Dst IP: 192.168.1.3 SW2 MAC Address Table
MAC Interface Src MAC: 0C2F.B011.9D00 MAC Interface
Dst MAC: FFFF.FFFF.FFFF
.9D00 G0/0 .9D00 G0/2

Src IP: 192.168.1.1

Dst IP: 192.168.1.3
Src MAC: .9D00
Dst MAC: ???
 ARP Reply
MAC: 0C2F.B011.9D00 MAC: 0C2F.B06A.3900
192.168.1.0/24
PC1 G0/0 G0/0 PC3
.1
G0/2 G0/2 .3
ARP Rep
.2 .4
PC2 G0/1 PC4
SW1 SW2 G0/1
MAC: 0C2F.B084.6200 ARP REPLY MAC: 0C2F.B01E.0A00
Src IP: 192.168.1.3
SW1 MAC Address Table Dst IP: 192.168.1.1 SW2 MAC Address Table
MAC Interface Src MAC: 0C2F.B06A.3900 MAC Interface
Dst MAC: 0C2F.B011.9D00
.9D00 G0/0 .9D00 G0/2

Src IP: 192.168.1.1

Dst IP: 192.168.1.3
Src MAC: .9D00
Dst MAC: ???
 ARP Reply
MAC: 0C2F.B011.9D00 MAC: 0C2F.B06A.3900
192.168.1.0/24
PC1 G0/0 G0/0 PC3
.1
G0/2 G0/2 .3
ARP Rep
.2 .4
PC2 G0/1 known unicast
G0/1 frame PC4
SW1 SW2
= forward (not flood)
MAC: 0C2F.B084.6200 ARP REPLY MAC: 0C2F.B01E.0A00
Src IP: 192.168.1.3
SW1 MAC Address Table Dst IP: 192.168.1.1 SW2 MAC Address Table
MAC Interface Src MAC: 0C2F.B06A.3900 MAC Interface
Dst MAC: 0C2F.B011.9D00
.9D00 G0/0 .9D00 G0/2

Src IP: 192.168.1.1 .3900 G0/0

Dst IP: 192.168.1.3
Src MAC: .9D00
Dst MAC: ???
 ARP Reply
MAC: 0C2F.B011.9D00 MAC: 0C2F.B06A.3900
192.168.1.0/24
PC1 ARP Rep G0/0 G0/0 PC3
.1
G0/2 G0/2 .3
.2 .4
PC2 G0/1 PC4
SW1 SW2 G0/1
MAC: 0C2F.B084.6200 ARP REPLY MAC: 0C2F.B01E.0A00
Src IP: 192.168.1.3
SW1 MAC Address Table Dst IP: 192.168.1.1 SW2 MAC Address Table
MAC Interface Src MAC: 0C2F.B06A.3900 MAC Interface
Dst MAC: 0C2F.B011.9D00
.9D00 G0/0 .9D00 G0/2
.3900 G0/2 Src IP: 192.168.1.1 .3900 G0/0
Dst IP: 192.168.1.3
Src MAC: .9D00
Dst MAC: ???
ARP Table

●
Use arp -a to view the ARP table
(Windows, macOS, Linux)
●
Internet Address = IP address
(Layer 3 address)
●
Physical Address = MAC address
(Layer 2 address)
●
Type static = default entry
●
Type dynamic = learned via ARP
Ethernet LAN Switching

gns3.com
Ethernet LAN Switching

PING
Src IP: 192.168.1.1
Dst IP: 192.168.1.3
Src MAC: 0C2F.B011.9D00
Dst MAC: ???
Ethernet LAN Switching

PING
Src IP: 192.168.1.1
Dst IP: 192.168.1.3
Src MAC: 0C2F.B011.9D00
Dst MAC: ???
Ethernet LAN Switching

PING
Src IP: 192.168.1.1
Dst IP: 192.168.1.3
Src MAC: 0C2F.B011.9D00
Dst MAC: 0C2F.B06A.3900
 Ping

●
A network utility that is used to test reachability
●
Measures round-trip time
●
Uses two messages:
ICMP Echo Request
ICMP Echo Reply
●
Command to use ping: ping (ip-address)
Ping
Ping
MAC Address Table
 MAC Address Table
MAC: 0C2F.B011.9D00 MAC: 0C2F.B06A.3900
192.168.1.0/24
PC1 G0/0 G0/0 PC3
.1
G0/2 G0/2 .3
.2 .4
PC2 G0/1 PC4
SW1 SW2 G0/1
MAC: 0C2F.B084.6200 MAC: 0C2F.B01E.0A00

SW1 MAC Address Table SW2 MAC Address Table

MAC Interface MAC Interface
.9D00 G0/0 .9D00 G0/2
.3900 G0/2 .3900 G0/0
Clearing the MAC Address Table

Aging
Clearing the MAC Address Table
Clearing the MAC Address Table
Ethernet Frame
Ethernet Frame
Ethernet Frame
 Topics we covered

●
Ethernet frame payload minimum size
●
ARP (Address Resolution Protocol)
ARP Request
ARP Reply
●
ARP table
●
Ping
ICMP Echo Request
ICMP Echo Reply
●
MAC Address Table
QUIZ
 Quiz Question 1

You send a 36-byte ping to another computer and perform a packet

capture to analyze the network traffic. You notice a long series of bytes of
00000000 at the end of the Ethernet payload. How can you explain these
zeroes?
a) Pings are a series of zeroes. The ping you sent was 36 bytes, but the
minimum Ethernet payload size is 46 bytes,
b) They are padding bytes. so a series of padding bytes must be added
to meet the minimum payload size.
c) They are the Ethernet FCS.
 Quiz Question 2

Which of these messages is sent to all hosts on the local network?

a) ARP request
b) ARP reply
c) ICMP echo request
d) ICMP echo reply
 Quiz Question 2

xb) ARP Reply

The ARP reply message is a unicast message sent to the host that sent
the ARP request.
 Quiz Question 2

xc) ICMP echo request, d)

x ICMP echo reply

The ICMP echo request is a unicast message used to test the

reachability of another specific host. The ICMP echo reply is a unicast
reply to the request.
 Quiz Question 2

a) ARP request

The ARP request message is used to learn the Layer 2 address of a

host. Because the Layer 2 address is not yet known, the message has
to be broadcast to all hosts on the local network.
 Quiz Question 3

Which fields are present in the output of the show mac address-table
command on a Cisco switch?

a) MAC Address, Ports

b) VLAN, MAC Address, Ports
c) VLAN, MAC Address, Type, Ports
d) Internet Address, Physical Address, Type
 Quiz Question 3

c) VLAN, MAC address, Type, Ports

Quiz Question 3
 Quiz Question 4

Which types of frames does a switch send out of all interfaces, except the
one the frame was received on?

a) Broadcast, unknown unicast

b) Broadcast, known unicast
c) Known unicast, unknown unicast
d) Broadcast, unknown unicast, known unicast
 Quiz Question 4

xb) Broadcast, known unicast

xc) Known unicast, unknown unicast
xd) Broadcast, unknown unicast, known unicast
Known unicast frames are sent to a single host. Because the switch
already has an entry for the destination in its MAC address table,
there is no need to flood the frame out all interfaces.
 Quiz Question 4

a) Broadcast, unknown unicast

Broadcast frames have a destination address of FFFF.FFFF.FFFF and
are sent to all hosts on the local network.
Unknown unicast frames are destined for a single host, however the
switch doesn’t have an entry for the destination in its MAC address
table so it must flood the frame.
 Quiz Question 5

Which command is used on a Cisco switch to clear all dynamic MAC

addresses on a specific interface from the MAC address table?

a) clear mac address-table interface interface-id

b) clear mac-address-table dynamic interface interface-id
c) clear mac-address table dynamic interface interface-id
d) clear mac address-table dynamic interface interface-id
 Supplementary Materials

●
Review flash cards
(link in the description)

●
Packet Tracer lab