Switching: how a frame crosses a switch

By reading the source MAC address of every frame that arrives and recording it against the port it came in on.

• Learning is always from the source field, never the destination.
• Entries are keyed by VLAN as well as address, so the same MAC can appear twice legitimately.
• Dynamic entries age out after 300 seconds of silence by default.

This works because any device that expects to receive traffic must first transmit something — ARP, DHCP or a routing protocol hello — which carries its address in the source field.

Forward it out one port, flood it out every port except the arrival port, or filter it and drop it.

• Forward happens when the destination is a known unicast on a different port.
• Flood happens for broadcasts, unresolved multicast, and unknown unicast destinations.
• Filter happens when the destination is known to be reachable out the same port the frame arrived on.

The never-send-back-out-the-arrival-port rule is what keeps flooding from echoing frames to their own sender and is a precondition for spanning tree working at all.

It is sending a unicast frame out every port because the destination is not in the table; persistent flooding wastes bandwidth on every port and lets every device see traffic meant for one.

• Brief flooding is normal while the table is being learned.
• Continuous flooding for an active device usually means the switch never sees frames from that device, so it never learns it.
• Common causes are asymmetric routing, a MAC ageing timer shorter than the router's ARP timer, and repeated topology changes clearing the table.

Deliberately induced, it is the goal of a MAC flooding attack, which fills the table with bogus entries so the switch floods everything and an attacker can capture it.

Twenty-four collision domains, one per port, and one broadcast domain per VLAN.

• Every port is a separate point-to-point link, so simultaneous transmissions on different ports cannot collide.
• With no VLANs configured, all 24 ports are in VLAN 1 and form a single broadcast domain.
• Configuring four VLANs gives four broadcast domains and still 24 collision domains.

Because full duplex removes collisions entirely, the collision-domain count is mostly a way of contrasting a switch with the hub it replaced.

Because each link is point-to-point and full duplex, so transmission and reception happen on separate pairs and nothing can collide.

• CSMA/CD existed to arbitrate a shared medium, which a switch port is not.
• Full-duplex interfaces disable it entirely.
• It only reappears when a link accidentally runs half duplex, which is a fault to fix rather than a mode to support.

Wireless is the modern shared medium and uses CSMA/CA instead, avoiding collisions in advance rather than detecting them, because a radio cannot listen while transmitting.

Store-and-forward reads the entire frame and verifies its checksum before forwarding; cut-through starts forwarding as soon as it has read the destination address.

• Store-and-forward discards corrupt frames, adds latency proportional to frame size, and is required for quality of service and speed conversion.
• Cut-through has fixed, very low latency but propagates corrupt frames.
• Fragment-free is a compromise that reads the first 64 bytes, catching collision fragments.

Cisco Catalyst switches are store-and-forward; cut-through survives in specialised low-latency hardware where microseconds are worth more than the occasional bad frame.

Almost certainly a duplex mismatch, and occasionally a cable longer than 100 metres.

• A late collision is one detected after the first 64 bytes, which cannot happen on a correctly built link.
• The half-duplex end counts late collisions; the full-duplex end counts CRC errors and runts.
• The link stays up and only fails under load, so monitoring often shows nothing.

The fix is to make both ends match — modern practice is autonegotiation on both — and hardcoding one side only is what creates the problem in the first place.

The switch shut the port down itself in response to a condition it was configured to treat as a violation.

• Common causes are port-security violations, BPDU guard triggering, link flapping and EtherChannel misconfiguration.
• show interfaces status err-disabled names the specific cause.
• Clearing it means shutdown then no shutdown, or configuring errdisable recovery for that cause with an interval.

Automatic recovery is convenient but hides the underlying problem, so it is usually enabled only for causes that are expected to be transient.

Congestion: more traffic wanted to leave the port than it could carry, so the buffer filled and frames were discarded. It is not a fault in the link.

• Typical causes are many ports sending to one, or a fast port feeding a slower one.
• Bursts happen on a millisecond scale that five-minute utilisation averages hide entirely.
• The fixes are more bandwidth, quality of service to choose what gets dropped, or deeper buffers.

At scale this is the incast problem, where many servers answer one request at once and overwhelm the buffer facing the requester, stalling TCP for whole round trips.

Because every frame from every device beyond that link arrives through it, so the switch learns all of those source addresses against that one port.

• Access ports typically show one address, or a handful when a phone and a PC share a port.
• Server ports running virtual machines show one address per virtual NIC.
• This is why port security limits are set per port role rather than globally.

The distribution of addresses across ports is a quick sanity check on a topology: an access port with fifty addresses is either a hidden switch or a hypervisor nobody documented.

It says what protocol the payload belongs to, so the receiver hands it to the right stack.

• 0x0800 is IPv4, 0x86DD is IPv6, 0x0806 is ARP.
• 0x8100 means an 802.1Q VLAN tag follows, with the real type after it.
• Values below 1536 mean the field is a length instead, from the older frame format.

The VLAN case is why tagged frames are four bytes longer than untagged ones, and why a device that does not understand tagging reports them as giants.

Because a change in the spanning-tree topology means traffic may now reach devices through different ports, so existing entries could be wrong.

• Keeping stale entries would black-hole traffic until they aged out, which could be five minutes.
• Spanning tree signals the change and switches shorten the ageing time or flush the table.
• The cost is a burst of flooding while the table rebuilds.

This is why a flapping access port that has not been configured with PortFast is disruptive far beyond its own link: each transition triggers topology-change handling across the switched network.

Clear the counters on the ports in the path, generate the traffic that is slow, and look at what increments.

• Rising CRC errors or runts point at the physical layer — cable, connector, transceiver.
• Rising late collisions point at a duplex mismatch.
• Rising output drops point at congestion, which is a capacity or queuing question rather than a fault.
• Nothing incrementing points away from the switch entirely.

The clearing step is what makes this work: totals accumulated since the last reboot tell you almost nothing, whereas a rate over a known interval is a measurement.

Whether they are in the same VLAN, and whether anything is filtering between them.

• show interfaces status shows the VLAN of each access port immediately.
• Different VLANs means the traffic needs routing, and the router may not permit it.
• Protected ports or a private VLAN configuration would also block port-to-port traffic while allowing the uplink.

Reaching the internet while not reaching each other is the useful clue: it proves both ports work and the uplink path is fine, so the difference has to be a policy applied between them.

Because the sender is on that port, so returning the frame would at best waste bandwidth and at worst create a loop.

• It applies to flooding, which goes to all ports except the arrival port.
• It also underpins the filter action, where a known destination on the arrival port causes a drop.
• Without the rule, a broadcast would circulate indefinitely even on a single switch.

The rule alone is not enough once there are multiple switches with redundant links, which is exactly the gap spanning tree fills.