Ethernet LAN Switching

LAN Basics

• LAN = Local Area Network (small area)
• Switches do not separate LANs
• Routers separate LANs (1 router interface = 1 LAN)

---

Data Encapsulation: PDUs

• Data → Segment → Packet → Frame
• Ethernet Frame = encapsulated Packet

---

Ethernet Frame Structure

[ Preamble (7) | SFD (1) | Destination MAC (6) | Source MAC (6) | Type/Length (2) | Data | FCS (4) ]

• Frame Total: 64 to 1518 bytes (excluding jumbo frames)
• Min payload: 46 bytes → if smaller, switch adds padding

---

Ethernet Header (14 bytes)

• Destination MAC (6 bytes)
• Source MAC (6 bytes)
• Type/Length (2 bytes)
  → depends on Ethernet version:
  • ≤1500: length (802.3)
  • ≥1536: type (Ethernet II, e.g. 0x0800 for IPv4, 0x86DD for IPv6)

Preamble + SFD (not technically part of header)

• Preamble: 10101010 × 7 (7 bytes) — for clock sync
• SFD: 10101011 (1 byte) — marks frame start

---

Ethernet Trailer (4 bytes)

• FCS (Frame Check Sequence):
  • Uses CRC to detect errors
  • Receiver discards frame if CRC check fails

---

MAC Address (6 bytes)

• Globally unique (burned-in at manufacturing)
• Format: AAAA.AA00.0001
  • First 3 bytes = OUI (manufacturer)
  • Last 3 bytes = device-specific

---

Hexadecimal and Decimal Quick Recap

• HEX: 0–9 + A(10)–F(15)
• 0x1B = 1×16 + 11 = 27
• CDE = C×256 + D×16 + E = 3294

---

MAC Address Table (Switch)

• Built by learning Source MACs
• Used to forward or flood frames:
  • Known Unicast: Forward
  • Unknown Unicast: Flood
• Dynamic MACs: expire after 5 min of inactivity (Cisco default)

Show & Clear Commands

show mac address-table

clear mac address-table dynamic

clear mac address-table dynamic address 0f0f.0f0f.0f0f

clear mac address-table dynamic interface f0/0

---

ARP (Address Resolution Protocol)

• Resolves L3 IP → L2 MAC
• Request: Broadcast FF:FF:FF:FF:FF:FF
• Reply: Unicast
• Switch floods ARP Request if destination is unknown
• ARP Table: stored on PC
  MAC Table: stored on switch

Show ARP

arp -a # Windows show arp # Cisco

---

ICMP (Ping)

• Layer 3 (Network), but uses MAC (L2) for delivery
• Echo Request → Echo Reply (Unicast)
• First ping may fail if ARP resolution not done
• Cisco: ping shows 5 pings, each 100 bytes → output .!!!!

---

MAC vs ARP vs ICMP vs DHCP

Table/Protocol	Device	Fields	Learning Method	Type	Notes
MAC Table	Switch	MAC–Port	Passive (from traffic)	Flood/Forward	Aged after 5 min
ARP Table	Host	IP–MAC	Active (via ARP)	Request/Reply	Separate from MAC table
ICMP	Host	Ping	Active	Unicast (needs ARP)	Echo Request/Reply
DHCP	Host	IP, GW, DNS	Active	DORA	Needs MAC to work

---

Tools

• Wireshark – packet capture & analysis
• GNS3 – emulator for real Cisco IOS (requires license)

📌 These are personal study notes. Please read the full disclaimer for more information.