Ethernet LAN Switching – Kotenko IT Blog

LAN Basics

LAN = Local Area Network (small area)
Switches do not separate LANs
Routers separate LANs (1 router interface = 1 LAN)

Data Encapsulation: PDUs

Data → Segment → Packet → Frame
Ethernet Frame = encapsulated Packet

Ethernet Frame Structure

Frame Total: 64 to 1518 bytes (excluding jumbo frames)
Min payload: 46 bytes → if smaller, switch adds padding

Ethernet Header (14 bytes)

Destination MAC (6 bytes)
Source MAC (6 bytes)
Type/Length (2 bytes)
→ depends on Ethernet version:
- ≤1500: length (802.3)
- ≥1536: type (Ethernet II, e.g. 0x0800 for IPv4, 0x86DD for IPv6)

Preamble + SFD (not technically part of header)

Preamble: 10101010 × 7 (7 bytes) — for clock sync
SFD: 10101011 (1 byte) — marks frame start

Ethernet Trailer (4 bytes)

FCS (Frame Check Sequence):
- Uses CRC to detect errors
- Receiver discards frame if CRC check fails

MAC Address (6 bytes)

Globally unique (burned-in at manufacturing)
Format: AAAA.AA00.0001
- First 3 bytes = OUI (manufacturer)
- Last 3 bytes = device-specific

Hexadecimal and Decimal Quick Recap

HEX: 0–9 + A(10)–F(15)
0x1B = 1×16 + 11 = 27
CDE = C×256 + D×16 + E = 3294

MAC Address Table (Switch)

Built by learning Source MACs
Used to forward or flood frames:
- Known Unicast: Forward
- Unknown Unicast: Flood
Dynamic MACs: expire after 5 min of inactivity (Cisco default)

Show & Clear Commands

show mac address-table

clear mac address-table dynamic

clear mac address-table dynamic address 0f0f.0f0f.0f0f

clear mac address-table dynamic interface f0/0

ARP (Address Resolution Protocol)

Resolves L3 IP → L2 MAC
Request: Broadcast FF:FF:FF:FF:FF:FF
Reply: Unicast
Switch floods ARP Request if destination is unknown
ARP Table: stored on PC
MAC Table: stored on switch

Show ARP

arp -a # Windows show arp # Cisco

ICMP (Ping)

Layer 3 (Network), but uses MAC (L2) for delivery
Echo Request → Echo Reply (Unicast)
First ping may fail if ARP resolution not done
Cisco: ping shows 5 pings, each 100 bytes → output .!!!!

MAC vs ARP vs ICMP vs DHCP

Table/Protocol	Device	Fields	Learning Method	Type	Notes
MAC Table	Switch	MAC–Port	Passive (from traffic)	Flood/Forward	Aged after 5 min
ARP Table	Host	IP–MAC	Active (via ARP)	Request/Reply	Separate from MAC table
ICMP	Host	Ping	Active	Unicast (needs ARP)	Echo Request/Reply
DHCP	Host	IP, GW, DNS	Active	DORA	Needs MAC to work

Tools

Wireshark – packet capture & analysis
GNS3 – emulator for real Cisco IOS (requires license)

📌 These are personal study notes. Please read the full disclaimer for more information.

Category: CCNA