Computer Networks

Physical And Data Link Layers

Switching, ARP and VLANs

A switch is not configured with which device is on which port. It works it out by watching.

JrCodex·9 min read

Jr Codex Computer Networks Notes

Level: Intermediate Prerequisites: Chapter 3: MAC Addressing and Ethernet Time to complete: ~20 minutes

Table of Contents

  1. How a Switch Learns
  2. Forwarding Decisions
  3. Loops and Spanning Tree
  4. ARP
  5. Collision and Broadcast Domains
  6. VLANs
  7. Summary & Next Steps

1. How a Switch Learns

A switch is not configured with which device is on which port. It works it out by watching.

BACKWARD LEARNING
─────────────────────────────────────────
  When a frame arrives on port P with source MAC M:

      record "M is reachable via port P"

  That is the whole algorithm. The switch learns
  from the SOURCE address of traffic it happens to
  see, and uses it to forward on DESTINATION
  addresses later.
─────────────────────────────────────────

import time
 
class Switch:
    def __init__(self, ports, age_seconds=300):
        self.ports, self.age = ports, age_seconds
        self.table = {}                      # mac -> (port, last_seen)
 
    def receive(self, frame, in_port):
        self.table[frame.src_mac] = (in_port, time.time())      # LEARN from the source
 
        if frame.dst_mac == "ff:ff:ff:ff:ff:ff":
            return self._flood(in_port)                          # broadcast
 
        entry = self.table.get(frame.dst_mac)
        if entry and time.time() - entry[1] < self.age:
            out_port = entry[0]
            if out_port == in_port:
                return []                                        # FILTER: same segment
            return [out_port]                                    # FORWARD: one port only
 
        return self._flood(in_port)          # UNKNOWN destination ──► flood and learn later
 
    def _flood(self, in_port):
        return [p for p in self.ports if p != in_port]           # everywhere but back
Three Behaviours, Named
─────────────────────────────────────────
  LEARN     record the source MAC and its port
  FORWARD   destination known ──► send to that
            port only
  FLOOD     destination unknown or broadcast ──►
            send to every port except the incoming
            one
  FILTER    destination is on the SAME port it
            arrived on ──► drop it; it already got
            there
─────────────────────────────────────────

Why Flooding Is Not a Flaw
─────────────────────────────────────────
  An unknown destination is flooded once. The reply
  teaches the switch where that device is, and
  every subsequent frame is forwarded precisely.

  So a switch converges on correct behaviour with
  no configuration, automatically, and re-learns
  when devices move. Entries AGE OUT after a few
  minutes so a moved device is not stuck.
─────────────────────────────────────────

2. Forwarding Decisions

Three Forwarding Modes
─────────────────────────────────────────
  STORE-AND-FORWARD
    Receive the ENTIRE frame, verify the CRC
    (Chapter 2), then forward.
    + never propagates a corrupt frame
    - latency equal to the whole frame's
      transmission time
    ── the default, and what almost everything uses

  CUT-THROUGH
    Read only the destination MAC (first 6 bytes
    after the preamble) and start forwarding
    immediately.
    + minimal latency
    - forwards corrupt frames, since the CRC is at
      the END

  FRAGMENT-FREE
    Wait for the first 64 bytes — enough to catch
    collision fragments — then forward.
    A compromise; largely historical.
─────────────────────────────────────────

Where Cut-Through Still Matters
─────────────────────────────────────────
  High-frequency trading and some HPC
  interconnects, where microseconds are worth
  propagating the occasional bad frame.

  Everywhere else, store-and-forward's error
  containment is worth the latency — and on a
  10 Gbps link, a 1500-byte frame takes 1.2
  microseconds anyway.
─────────────────────────────────────────

3. Loops and Spanning Tree

Why a Loop Is Catastrophic at Layer 2
─────────────────────────────────────────
  Redundant links between switches create a cycle.

        A ─── B
        │     │
        └─ C ─┘

  A broadcast frame arrives at A. A floods it to B
  and C. B floods it to C. C floods it to A and B.
  Forever.

  THE ETHERNET HEADER HAS NO TTL. Nothing decrements,
  nothing expires. The frame circulates
  indefinitely, multiplying at every switch.

  Within seconds the network is saturated and
  completely unusable. This is a BROADCAST STORM,
  and it is the most destructive layer 2 failure.
─────────────────────────────────────────

Contrast With Layer 3
─────────────────────────────────────────
  An IP packet has a TTL field, decremented at each
  hop, and discarded at zero (Module 3, Chapter 5).

  So an IP routing loop wastes bandwidth briefly
  and then stops. A layer 2 loop never stops.

  This single difference is why spanning tree is
  necessary and IP needs no equivalent.
─────────────────────────────────────────

SPANNING TREE PROTOCOL
─────────────────────────────────────────
  1. Switches elect a ROOT BRIDGE — lowest bridge
     ID wins
  2. Each switch finds its lowest-cost path to the
     root
  3. Ports NOT on that tree are BLOCKED — they
     forward nothing
  4. The result is a loop-free TREE over a
     physically looped topology
  5. If a link fails, blocked ports are unblocked
     to restore connectivity

  Physical redundancy is kept; logical loops are
  removed.

  Classic STP took 30-50 seconds to converge. Rapid
  STP does it in a few seconds, and is what you
  should be running.
─────────────────────────────────────────

4. ARP

The bridge between the two address worlds from Chapter 3.

The Problem
─────────────────────────────────────────
  Your machine wants to send an IP packet to
  192.168.1.50 on the same LAN.

  To put it in an Ethernet frame it needs that
  host's MAC ADDRESS. It knows only the IP.

  ARP — Address Resolution Protocol — asks.
─────────────────────────────────────────

The Exchange
─────────────────────────────────────────
  REQUEST — sent as a BROADCAST
    to:   ff:ff:ff:ff:ff:ff
    "Who has 192.168.1.50? Tell 192.168.1.10"

  Every device on the LAN receives it. Only the
  owner of that IP replies.

  REPLY — sent as a UNICAST
    "192.168.1.50 is at 00:1A:2B:3C:4D:5E"

  The result is cached in the ARP TABLE for a few
  minutes, so this happens once per destination,
  not once per packet.
─────────────────────────────────────────

ip neigh show                    # the ARP cache on Linux
arp -a                           # macOS, Windows
ip neigh flush all               # clear it, to force re-resolution
The Case People Get Wrong
─────────────────────────────────────────
  Sending to a host on ANOTHER network:

  Your machine compares the destination IP with its
  own subnet mask (Module 3, Chapter 1) and sees it
  is REMOTE.

  So it ARPs for the DEFAULT GATEWAY, not for the
  destination.

  The frame carries:
    dst MAC = the ROUTER's MAC
    dst IP  = the FINAL destination's IP

  The router strips the frame, looks up the IP,
  builds a NEW frame with the next hop's MAC, and
  forwards.

  You never learn the remote host's MAC, and you
  never could — MAC addresses do not cross routers
  (Chapter 3).
─────────────────────────────────────────

ARP SPOOFING
─────────────────────────────────────────
  ARP has no authentication whatsoever. Any device
  may reply to any request, or send unsolicited
  replies.

  An attacker claims to be the gateway. Every
  machine on the LAN caches the lie and sends all
  its traffic through the attacker — a
  MACHINE-IN-THE-MIDDLE position on the local
  network.

  MITIGATIONS: dynamic ARP inspection on managed
  switches, static entries for critical hosts, and
  — most importantly — TLS, so intercepted traffic
  is unreadable anyway (Module 6, Chapter 3).
─────────────────────────────────────────

5. Collision and Broadcast Domains

The Two Domains
─────────────────────────────────────────
  COLLISION DOMAIN
    A set of devices whose transmissions can
    collide.
    A HUB makes all its ports one collision domain.
    A SWITCH makes EACH PORT its own.
    ── switches ELIMINATE collisions (Chapter 3)

  BROADCAST DOMAIN
    A set of devices that receive each other's
    broadcasts.
    A SWITCH forwards broadcasts to every port, so
    all its ports are ONE broadcast domain.
    A ROUTER does NOT forward broadcasts.
    ── routers BOUND broadcast domains
─────────────────────────────────────────

Why Broadcast Domains Must Be Bounded
─────────────────────────────────────────
  Every ARP request is a broadcast, processed by
  the CPU of every device in the domain.

  On a flat network of 5,000 devices, broadcast
  traffic becomes a measurable load on every
  machine, and one misbehaving device can degrade
  all of them.

  Rule of thumb: keep a broadcast domain to a few
  hundred devices. Beyond that, split it — with a
  router, or with VLANs.
─────────────────────────────────────────

6. VLANs

The Idea
─────────────────────────────────────────
  A VLAN partitions ONE physical switch into
  several logical switches.

  Ports 1-8   ──► VLAN 10 (Finance)
  Ports 9-16  ──► VLAN 20 (Engineering)
  Ports 17-24 ──► VLAN 30 (Guest)

  Devices in different VLANs CANNOT communicate at
  layer 2, even plugged into the same switch. Each
  VLAN is its own broadcast domain.
─────────────────────────────────────────

802.1Q TAGGING
─────────────────────────────────────────
  A 4-byte tag inserted into the Ethernet frame,
  after the source MAC:

    [DST | SRC | 802.1Q TAG | TYPE | PAYLOAD | FCS]
                 └ 12-bit VLAN ID (1-4094)

  ACCESS PORT   carries ONE VLAN. Frames are
                untagged — end devices know nothing
                about VLANs.
  TRUNK PORT    carries MANY VLANs between
                switches. Frames are tagged so the
                far switch knows which VLAN each
                belongs to.

  Note: the tag makes the frame 1518+4 = 1522
  bytes, which is why some equipment must be
  configured for "baby giant" frames.
─────────────────────────────────────────

Why VLANs Are Used Everywhere
─────────────────────────────────────────
  SECURITY      isolate guest wifi, payment
                systems, IoT devices — without
                separate physical switches

  BROADCAST     smaller domains without buying more
  CONTROL       hardware

  FLEXIBILITY   a device's VLAN follows its port
                configuration, not its physical
                location

  COST          one switch does the work of several
─────────────────────────────────────────

Inter-VLAN Routing
─────────────────────────────────────────
  VLANs are isolated at layer 2 BY DESIGN. To let
  them communicate you need a LAYER 3 device — a
  router, or a layer 3 switch.

  Which is the correct behaviour: you separated
  them deliberately, so traffic between them should
  pass a point where policy can be applied.

  Module 3 takes over from here.
─────────────────────────────────────────

7. Summary & Next Steps

Key Takeaways

  • A switch learns from the source address of frames it sees and forwards on the destination, converging on correct behaviour with no configuration.
  • Ethernet frames have no TTL, so a layer 2 loop never stops — which is why spanning tree is necessary while IP needs no equivalent.
  • When the destination is on another network, a host ARPs for its gateway rather than the destination, because MAC addresses do not cross routers.
  • Switches bound collision domains and routers bound broadcast domains; VLANs let one switch create several broadcast domains without extra hardware.

Concept Check

  1. Why is a switching loop far more destructive than an IP routing loop?
  2. Your machine sends a packet to a server on the internet. Whose MAC address is in the frame, and why?
  3. Two devices are in different VLANs on the same switch. What is needed for them to communicate, and why is that the right design?

Module 2 Complete — What's Next

You can now move a frame to the right device on a single link. Module 3 solves the limitation that has been implicit throughout: everything so far reaches exactly one hop.

Next Module

→ Module 3: The Network Layer

Jr Codex — 1-on-1 Personalized Coaching | Back to Module Index | Back to Computer Networks Index