LAN switching: the MAC table, ARP, domains

1What we take apart today

In laboratory 1 you issued a ping and it worked. Nobody explained why the switch knew where to send the frame. Today you find out, and the answer has only three rules.

There is a fourth, rarer situation: if the destination is on the very port of arrival, the switch discards the frame (drop) - the two hosts hear each other directly anyway.

2Equipment needed

Optionally, for the last assignment: one more 2960 switch and a Copper Cross-Over cable.

3The topology to build

There is no router and no gateway is needed: every host is in the same network. The SW1 Fa0/4 – HUB1 link is made with straight-through cable.

4The workbench

The topology of figure 1, cabled and addressed. Every section that follows can be done here; open it in a tab beside the text and work as you read.

5The MAC table, watched as it fills

1. Note the MAC addresses of the hosts

   For every host, open the terminal (in Packet Tracer: Desktop → Command Prompt) and run:

   on every hostcopy

   ipconfig /all
   

   Note the Physical Address field - it is the MAC address. You will need these six values at every step that follows; without them, the table of the switch is a meaningless string of digits.

2. Empty the table and check that it is empty
   on SW1copy

   Switch> enable
   Switch# clear mac address-table dynamic
   Switch# show mac address-table
   

   No entry must appear. If some still do, it means traffic has passed in the meantime - repeat the two commands one straight after the other.

3. A single frame, and look at what has happened

   From PC-A, issue a single ping towards PC-B, then come straight back to SW1:

   on PC-Acopy

   ping -n 1 192.168.5.11
   

   on SW1copy

   SW1# show mac address-table
   

   Question

   How many entries appeared, and where did the switch learn each of them from?

   See the answer

   Two: the MAC of PC-A on Fa0/1 and the MAC of PC-B on Fa0/2. The first was learned from the ARP request of PC-A - a broadcast, therefore flooded out of every port. The second, from the ARP reply of PC-B. The ping itself had nothing left to teach: by the time it left, the switch already knew everything.

   The conclusion that matters: the switch does not learn from ping. It learns from any frame that passes through it, whatever it contains.

4. The three actions, one at a time

   Empty the table again and run the scenarios in the order below. In Packet Tracer switch to Simulation and filter on ICMP and ARP, so that you see the envelopes. In the workbench in this page, watch the MAC table after each step.

   Scenario	What the switch does	How you check
   PC-A → PC-B, with the table empty	flood: the frame leaves out of every port except Fa0/1	the table was empty, so the destination was unknown
   PC-B → PC-A, straight afterwards	unicast: only out of Fa0/1	show mac address-table already contains PC-A
   PC-A → broadcast	flood, always	in Packet Tracer: ping 192.168.5.255

5. The ageing of entries
   on SW1copy

   SW1# show mac address-table aging-time
   SW1# configure terminal
   SW1(config)# mac address-table aging-time 30
   SW1(config)# end
   

   The default value is 300 seconds. Reduce it to 30, generate traffic from PC-C, then leave the network quiet and watch the table every 15 seconds: the entry disappears. (The passage of time can only be observed in Packet Tracer; in the workbench in this page the command is accepted, but the table does not age by itself.)

   Why ageing is needed If you move PC-C from Fa0/3 to Fa0/5, the switch would carry on sending its traffic out of the old port - indefinitely. In practice, the first frame sent by PC-C from the new port corrects the entry at once; ageing covers the case where the host has left and no longer speaks at all.

   Check this right now, in the workbench: pick PC-C, in the Cables panel press unplug, then connect towards SW1 : Fa0/5. Issue a ping from PC-C and look again at show mac address-table: the entry has moved to the new port by itself.

6Switch versus hub

The right-hand part of the topology exists for one reason only: so that you see the difference instead of imagining it.

1. Traffic through the hub

   From PC-D issue a ping towards PC-E. In Packet Tracer, in Simulation, follow the envelope.

   The hub sends it out of every port - including to PC-F, which has nothing to do with this conversation, and back towards the switch. PC-F receives the frame, looks at the destination MAC address, finds that it is not its own and discards it. Time and bandwidth spent for nothing, on every single frame.

   In the workbench in this page, check the consequence on the switch: after a ping between two hosts attached to the hub, show mac address-table on SW1 shows both addresses on the same port, Fa0/4. The switch has no way of separating them: from its point of view, everything beyond the hub sits on a single wire.

2. The collision, provoked Packet Tracer only

   Go back to Realtime. Open the terminals on PC-D and PC-F at the same time and launch from both, as close together in time as you can:

   on PC-D and PC-F, almost simultaneouslycopy

   ping -n 200 -l 1400 192.168.5.10
   

   Compare the response times with those obtained when you run alone. Repeat the experiment replacing the hub with a second switch and observe the difference.

3. Count the domains
   Exercise

   For the topology of figure 1, how many collision domains and how many broadcast domains are there?

   See the answer

   Collision domains: 5. SW1 creates one on each port: Fa0/1, Fa0/2, Fa0/3 and Fa0/4 - that is 4. The hub, together with PC-D, PC-E, PC-F and the link towards the switch, forms a single domain - the fifth. Careful: the SW1–HUB1 link belongs to the domain of the hub, not to a separate one.

   Broadcast domains: 1. There is no router and no VLAN, so all six hosts hear each other in broadcast. A ping 192.168.5.255 from PC-A reaches everybody.

7ARP, with the cache emptied

1. Clear the cache and look at the request
   on PC-Acopy

   arp -d
   arp -a
   ping -n 1 192.168.5.12
   arp -a
   

   The first display must say No ARP Entries Found. After the ping, the address of PC-C appears together with its MAC. This is the whole mechanism: a question, an answer, a note remembered for a few minutes.

   In Packet Tracer, follow the ARP request in Simulation and read from Outbound PDU Details:

   • the destination MAC address of the frame: FFFF.FFFF.FFFF - broadcast;
   • the Target MAC field of the ARP packet: zeros - exactly what is being asked for;
   • the Target IP field: the address of PC-C.

   Every host receives the request. Only PC-C answers; the others ignore it silently.

2. The effect of the cache

   Issue ping 192.168.5.12 straight after arp -d and then once more. The first time the first packet is lost; the second time, none is. The difference is exactly the cost of ARP resolution.

   Remember the symptom In a network with problems, pings that "work, but fail the first time" almost always point to a matter of ARP, not of routing. It is the first thing you strike off the list.

8Managing the switch

So far we have configured the switch sitting at its console. In order to manage it remotely, it needs an IP address and a means of access protected by a password.

The commands below are typed line by line. Those beginning with ! are comments - they are not typed.

Switch> enable
Switch# configure terminal
Switch(config)# hostname SW1
SW1(config)# no ip domain-lookup

! the management address sits on the VLAN 1 virtual interface
SW1(config)# interface vlan 1
SW1(config-if)# ip address 192.168.5.2 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit

! the password for privileged mode
SW1(config)# enable secret Cisco123
SW1(config)# service password-encryption

SW1(config)# end
SW1# copy running-config startup-config

Check from two places:

SW1# show ip interface brief

Vlan1 must appear with 192.168.5.2 and up / up. If it appears as administratively down, you forgot no shutdown on the VLAN interface.

ping 192.168.5.2

Remote access

For a true SSH session, a domain name, a key and a user are also needed. These commands are demonstrated in Packet Tracer:

SW1(config)# ip domain-name retele.local
SW1(config)# crypto key generate rsa
! when asked about the key length, answer 1024
SW1(config)# username admin privilege 15 secret Admin123
SW1(config)# line vty 0 4
SW1(config-line)# transport input ssh
SW1(config-line)# login local
SW1(config-line)# exit
SW1(config)# banner motd #Authorized access only#

ssh -l admin 192.168.5.2

9Port security

A switch port accepts, by default, any MAC address presented to it. Port security limits the number of addresses that may be learned on a port and decides what happens when the limit is exceeded - the first defence against the CAM overflow attack from lecture 12.

SW1# configure terminal
SW1(config)# interface fastEthernet 0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 1
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation shutdown
SW1(config-if)# end

SW1# show port-security
SW1# show port-security interface fastEthernet 0/1
SW1# show running-config

Issue a ping from PC-A, then look again at show running-config: the MAC address of PC-A has been "stuck" automatically into the configuration. That is what sticky does.

Provoke the violation

In the workbench in this page, moving the cable is done from the Cables panel:

1. Pick PC-A and press unplug on port Fa0.
2. Pick PC-C, press unplug, then connect and choose SW1 : Fa0/1.
3. Issue a ping from PC-C towards PC-B.
4. On SW1: show interfaces status - the port appears as err-disabled.

SW1# configure terminal
SW1(config)# interface fastEthernet 0/1
SW1(config-if)# shutdown
SW1(config-if)# no shutdown
SW1(config-if)# end

10Assignments

• Build the topology and verify complete connectivity between all six hosts
• Document, with screenshots, the three actions of the switch: unicast, flood, drop
• Justify in writing the number of collision and broadcast domains in the topology
• Compare the response times through the hub and through the switch, under simultaneous traffic
• Configure the management of SW1 completely and demonstrate a successful SSH connection
• Configure port security on all three access ports, with restrict, and provoke a violation on one of them
• Add a second switch attached to SW1 and explain what happens to the domains

11Going further

12Self-check questions

13Deliverables