🔀 Phase 2 · Switching 🟠 Intermediate MODULE 07

Ethernet Switching

⏱️ 3 hours

📖 Theory + IOS Labs

🧩 10 Questions

🔬 1 Lab

Phase 2 progress0%

🎯 What you'll learn: Ethernet frame structure and fields, MAC address format and types (unicast/broadcast/multicast), how switches learn and forward frames, the MAC address table (CAM table), and switch forwarding methods (store-and-forward vs cut-through).

Section 1

Ethernet Encapsulation

Ethernet (IEEE 802.3) is the dominant LAN technology — it handles the vast majority of all wired network traffic worldwide. The most common frame format is DIX Ethernet II (also called Ethernet Version 2), which uses an EtherType field to identify the upper-layer protocol. The original IEEE 802.3 format used a Length field and required 802.2 LLC headers — you'll still see references to both on the CCNA exam.

Preamble bytes — clock sync

SFD byte — frame start marker

Bytes per MAC address

Minimum Ethernet frame (bytes)

1518

Maximum standard frame (bytes)

FCS bytes — CRC error detection

Preamble

7 bytes

SFD

1 byte

Dest MAC

6 bytes

Src MAC

6 bytes

EtherType

2 bytes

Data / Payload

46–1500 bytes

FCS

4 bytes

Preamble (7) + SFD (1)

Clock Synchronization

7 bytes of alternating 10101010 for clock sync, followed by the SFD (10101011) indicating frame start. Not counted in the frame size for MTU purposes.

EtherType 0x0800

IPv4 — most common

2-byte field. 0x0800=IPv4, 0x86DD=IPv6, 0x0806=ARP. Values ≥ 0x0600 indicate Ethernet II; values ≤ 1500 indicate IEEE 802.3 (length field).

Min payload = 46 bytes

Minimum Frame Size

Ethernet requires a minimum 64-byte frame (header 14 + payload 46 + FCS 4). If payload is smaller, padding is added. This ensures CSMA/CD can detect collisions properly.

Section 2

MAC Address Format

A MAC address (Media Access Control address) is a 48-bit hardware identifier assigned to every network interface. It is used for Layer 2 addressing within a network segment. MAC addresses are expressed as 12 hexadecimal digits in various formats.

MAC address formats and IOS commands

IOS

! MAC address notation formats (all represent the same address):
AA:BB:CC:DD:EE:FF  ! Linux/macOS colon-separated
AA-BB-CC-DD-EE-FF  ! Windows hyphen-separated
AABB.CCDD.EEFF     ! Cisco IOS dot-separated (groups of 4)

! View MAC address in Windows
C:\> ipconfig /all
   Physical Address. . : AA-BB-CC-11-22-33

! View MAC on Cisco IOS
SW1# show interfaces fastethernet 0/1
  Hardware is Fast Ethernet, address is 0001.96a1.a41c (bia 0001.96a1.a41c)
  ! bia = burned-in address (the ROM address)
  ! Current address may differ if MAC was overridden in software

! View MAC address table on switch
SW1# show mac address-table
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0001.97f1.8101    DYNAMIC     Fa0/1
   1    0004.9a00.0000    DYNAMIC     Fa0/2
   1    0060.3e1e.c7c0    DYNAMIC     Fa0/3

The MAC address is split into two equal parts:

First 3 bytes (OUI)

Organizationally Unique Identifier

Assigned by IEEE to the manufacturer. Identifies who made the NIC. Cisco's OUI is 00-00-0C. Intel, Broadcom, and other NIC makers each have their own OUIs. You can look up any OUI online.

Last 3 bytes (Device ID)

Vendor-Assigned

Assigned by the manufacturer to make each NIC unique. Combined with the OUI, this creates a globally unique address — no two NICs should share a MAC address.

BIA vs Software MAC

Burned-In Address

The BIA is stored in ROM on the NIC. Modern operating systems allow overriding it in software (useful for testing, privacy, and VM networking). IOS shows both current and BIA.

Section 3

Unicast, Broadcast, and Multicast MAC Addresses

Not all MAC addresses represent a single device. The type of MAC address in the destination field tells the switch — and the receiving devices — who the frame is intended for.

UNICAST

AA:BB:CC:11:22:33

One specific destination device. The LSB of the first byte = 0. Switch forwards to only the port where that MAC is learned. Normal day-to-day communication.

BROADCAST

FF:FF:FF:FF:FF:FF

All devices on the segment. Switch floods out ALL ports except the incoming port. ARP requests use broadcast — "Who has IP x.x.x.x? Tell me!"

MULTICAST

01:00:5E:xx:xx:xx

A group of devices (multicast group members). LSB of first byte = 1. 01:00:5E prefix for IPv4 multicast. OSPF uses 01:00:5E:00:00:05 and 01:00:5E:00:00:06.

💡

How to identify unicast vs multicast: check the LSB of the first byte

Look at the Least Significant Bit (LSB) of the first byte of the MAC address. If LSB = 0, it is a unicast address. If LSB = 1, it is a multicast address. The broadcast address FF:FF:FF:FF:FF:FF is technically a special case of multicast (all bits set). In IPv4 multicast, MACs always begin with 01:00:5E, and the low-order 23 bits map to the multicast IP group address.

Section 4

How Switches Learn and Forward

Switches operate at Layer 2 and maintain a MAC Address Table (also called the CAM table — Content Addressable Memory). This table maps MAC addresses to switch ports, allowing the switch to make intelligent forwarding decisions rather than blindly flooding all traffic everywhere.

The four forwarding behaviors:

Unicast, MAC known, different port: forward out only that specific port
Unicast, MAC known, same port: filter (drop — device is on the same segment)
Unicast, MAC unknown: FLOOD out all ports except the incoming port (unknown unicast)
Broadcast (FF:FF:FF:FF:FF:FF): always FLOOD out all ports except incoming

MAC address aging: entries are removed from the table after 300 seconds (5 minutes) of inactivity by default. If a device goes offline, its MAC ages out so the table doesn't fill up with stale entries.

Switch Frame Processing Flow

Frame arrives on port

→

Learn Source MAC → add to table

→

Lookup Dest MAC

FOUND

↓

Same port?

YES

Filter (drop)

Forward to specific port

NOT FOUND

↓

Flood all ports except incoming

Watching a switch learn MAC addresses

IOS

! Initially empty — switch just powered on
SW1# show mac address-table dynamic
! (no entries)

! PC1 (MAC: 0001.0001.0001) pings PC2 (MAC: 0002.0002.0002)
! Switch learns PC1's MAC from the INCOMING frame source MAC
SW1# show mac address-table dynamic
Vlan    Mac Address       Type        Ports
   1    0001.0001.0001    DYNAMIC     Fa0/1   ! PC1 learned
! ARP broadcast floods to all — switch learns nothing from broadcast dest
! PC2 replies with ARP reply (unicast) — switch learns PC2
   1    0002.0002.0002    DYNAMIC     Fa0/2   ! PC2 learned
! All future PC1 ↔ PC2 frames: direct forwarding, no more flooding

! Clear the MAC table
SW1# clear mac address-table dynamic
! Default aging time: 300 seconds (5 minutes)
SW1# show mac address-table aging-time

Section 5

Switch Forwarding Methods

How fast a switch starts forwarding a frame depends on which forwarding method it uses. There is a fundamental trade-off between latency (how fast) and reliability (error checking). This is a direct CCNA exam topic.

Forwarding Method Latency Comparison

Store-and-Forward

Receives entire frame first

High latency

Fragment-Free

Reads first 64 bytes

Medium

Cut-Through

Reads dest MAC only

Low latency

Store-and-Forward

Enterprise Standard

Receives the ENTIRE frame before forwarding. Checks FCS — if CRC error, frame is dropped. Higher latency but reliable. Required for QoS. Used in all modern enterprise switches (Catalyst, Nexus).

Cut-Through

Low-Latency Mode

Starts forwarding after reading only the destination MAC (first 6 bytes of payload). Does NOT check FCS — corrupt frames get forwarded. Used where latency is critical: HFT trading floors, low-latency clusters.

Fragment-Free

Compromise Mode

Reads the first 64 bytes before forwarding. Catches most collision fragments (which are shorter than 64 bytes) but doesn't catch all errors. A middle ground between cut-through and store-and-forward.

✨

CCNA exam: store-and-forward vs cut-through

Store-and-forward: checks FCS, detects errors, drops corrupt frames — higher latency, used in enterprise. Cut-through: doesn't check FCS, no error detection — lower latency, used in latency-critical environments. The CCNA exam will ask you to identify which method performs error checking. Answer: store-and-forward.

Section 6

Switch Memory Buffering and Auto-Negotiation

When frames arrive faster than they can be forwarded (e.g., from a 1G uplink to a 100M downlink), switches use memory buffers to hold frames temporarily. Two methods exist:

Port-based memory: each port has its own dedicated buffer — frames queued per port. Simple but can waste memory if one port is idle.
Shared memory: all ports share a common memory pool — frames allocated dynamically. More efficient, especially when traffic is uneven across ports. Used in modern switch ASICs.

Auto-negotiation (IEEE 802.3u) allows connected devices to automatically agree on speed (10/100/1000 Mbps) and duplex (half/full). Both devices advertise their capabilities and choose the best match. If one end has auto-negotiation disabled and manually set, mismatches can occur — the auto-negotiating end will default to half-duplex if it cannot detect the other end's settings.

Auto-MDIX (Automatic Medium-Dependent Interface Crossover) automatically detects whether a straight-through or crossover cable is connected and adjusts the port's TX/RX pins accordingly. Modern switches support Auto-MDIX, eliminating the need to worry about cable type for switch-to-switch or switch-to-PC connections.

🔬

Lab — View MAC Address Table

Practice on Cisco IOS (Packet Tracer or real hardware)

Objective: Observe the MAC address table populating as devices communicate — the fundamental behavior of every Ethernet switch ever built.

Step 1: Access a Cisco switch (Packet Tracer topology or real hardware)
Step 2: Before connecting any devices: show mac address-table — confirm it is empty
Step 3: Connect two PCs to the switch on Fa0/1 and Fa0/2
Step 4: From PC1, ping PC2: ping 192.168.1.2
Step 5: Check the MAC table: show mac address-table dynamic
Step 6: Note which MACs appear on which ports — does it match the physical connections?
Step 7: Clear the table: clear mac address-table dynamic
Step 8: Verify it's empty again, then watch it repopulate with another ping

Expected result: After the ping, both PCs' MAC addresses appear in the table mapped to their respective ports (Fa0/1 and Fa0/2).

💡 Show hints

In Packet Tracer: drag a 2960 switch, two PCs, connect with straight-through cables
Assign IPs: PC1 = 192.168.1.1/24, PC2 = 192.168.1.2/24
Access switch CLI: click switch → CLI tab → press Enter
Command: show mac address-table dynamic (dynamic = learned, not static)
Why does PC1's MAC appear before PC2's? The ARP request (broadcast) teaches PC1's location; PC2 replies (unicast) teaching PC2's location

🧩 Knowledge Check

10 questions — Ethernet Switching

1. What is the size of a MAC address?

2. What does the OUI portion of a MAC address identify?

3. When a switch receives a frame with an unknown destination MAC address, it:

4. What is the Ethernet broadcast MAC address?

5. Store-and-forward switching differs from cut-through because:

6. The MAC address table maps:

7. What is the default aging time for MAC address table entries?

8. An Ethernet multicast MAC address begins with:

9. Which Ethernet frame field contains the CRC for error detection?

10. What command shows the dynamically learned MAC addresses on a Cisco switch?

Finished this module?

Mark it complete to track your progress.

Phase 2 · SwitchingModule 7 of 17