Chapter 7 - Analyzing Ethernet LAN Switching

What command would you run to view statistics about incoming and outgoing frames on an interface?

(show interfaces f0/1 counters) displays statistical information such as the number of unicast, multicast, and broadcast frames both the in and out direction, and a total byte count for those frames.

What command lets you show global and per-VLAN aging timeout for inactive MAC table entries?

(show mac address-table aging-time)

What command would you run to display the total number of MAC addresses a switch can learn?

(show mac address-table count) It will show an output similar to: Total Mac Address Space Available: ####

If you only have a few devices, utilizing the MAC address table on a switch is a breeze. However, when you have a large Enterprise network, the sheer volume of entries will start looking like a random string of hex characters. Therefore, what command would help you filter the list to find the MAC address you need?

(show mac address-table dynamic address XXXX.XXXX.XXXX) if you know the MAC address you are looking for. The switch will then display information only about that address. However, if you don't know the exact MAC address, but you know what VLAN it's associated with, you can instead run the following command (show mac address-table dynamic vlan vlan-id).

What is a switches general logic when forwarding frames with a full, or completely known MAC table?

1. A Ethernet frame entered an interface. 2. The (destination) MAC address is destined for XYZ. 3. The MAC table has an entry for XYZ out an interface. 4. The switch will forward that frame out that interface.

A switch receives Ethernet frames, and then makes switching decisions either by forwarding the frame out some port, or by ignoring the frame. Well, to accomplish this a switch has to perform three core functions. What are they?

1. Deciding when to forward a frame or when to filter (not forward) a frame, based on the destination MAC address. 2. Preparing to forward frames by learning MAC addresses by examining the source MAC address of each frame received by the switch. 3. Preparing to forward only one copy of the frame to the destination by creating a (Layer-2) loop-free environment with other switches by using Spanning Tree Protocol (STP). The first action is the switch's primary job, whereas the other two are overhead functions.

What are three key steps regarding a switches forwarding and blocking logic, how it learns and maps Ethernet frames, and STP?

1. Switches forward frames based on the destination MAC address: a. If the destination MAC address is a broadcast, multicast, or unknown destination unicast (a unicast not listed in the MAC table), the switch floods the frame. b. If the destination MAC address is a known unicast address (a unicast address found in the MAC table): i. If the outgoing interface listed in the MAC address table is different from the interface in which the frame was received, the switch forwards the frame out the outgoing interface. ii. If the outgoing interface is the same as the interface in which the frame was received, the switch filters the frame, meaning that the switch simply ignores the frame, and does not forward it. 2. Switches use the following logic to learn MAC address table entries: a. For each received frame, examine the source MAC address and note the interface from which the frame was received. b. If it is not already in the table, add the MAC address and interface it was learned on. 3. Switches use STP to prevent loops by causing some interfaces to block, meaning that they do not send or receive frames.

What are five settings that switches come pre-configured by default?

1. The interfaces are enabled by default, ready to start working once a cable is connected. 2. All interfaces are assigned to VLAN 1. 3. 10/100 and 10/100/1000 interfaces use auto-negotiation by default. 4. The MAC learning, forwarding, and flooding logic all works by default. 5. STP is enabled by default.

What is the default timer when MAC table entries get aged out?

300 seconds

Switch learning occurs by what method?

A Ethernet frame will enter a particular interface, and the switch will look at the source MAC address. It will then add the incoming interface as the associated port. The basic logic follows as such: "The source MAC address is ABCD, and the frame entered F0/1. Therefore, from my perspective, ABCD must be reachable out port F0/1."

What will a switch do if it receives an unknown frame?

A unknown frame, also commonly known as a unknown unicast frame will be flooded out all ports except the incoming interface it was received on. The reason being, if there are no entries in the MAC table associated with that destination MAC address, it will send it everywhere to deliver the frame. Spray and pray. This way all devices receive the Ethernet frame, and the appropriate device will likely send a reply - and then the switch can learn that device's MAC address, and forward future frames out one port as a known unicast frame.

Note: A switch's MAC address table is called the switching table, or bridging table, or even the ___ table , in reference to the type of physical memory used to store the table.

Content-Addressable Memory (CAM)

True or False? If a frame enters a port in VLAN 1, then the switch will forward or flood that frame out all other ports, even if they're in a different VLAN?

False. A switch will only forward or flood a frame inside the same VLAN. For example, if two devices are in VLAN 1, they can talk. However, if one device is in VLAN 1 and another device is in VLAN 2, you can not talk with the assistance of a router.

True or False? Switches stores MAC address for a indefinite period of time?

False. The switch will remove the entries due to age, due to the table filling, and you can remove entries manually using a command.

What is the primary job of a network switch?

It's sole goal in life is to forward Ethernet frames to the correct destination MAC address.

What's the purpose of STP?

STP simply put is uses for loop prevention. The reason being, if STP was disabled frames flooded frames would loop indefinitely. To prevent loops, STP blocks certain ports from forwarding frames so that only one active path exists between any pair of LAN segments.

What feature, or protocol do switches use to avoid loops?

Spanning Tree Protocol (STP)

What are two common states that STP uses for loop prevention?

Switch interfaces are most commonly going to be in either a forwarding state, or blocking state. Blocking means that the interface cannot forward or receive data frames, while forwarding means that the interface can send and receive data frames. If a correct subset of the interfaces is blocked, only a single currently active - logical path exists between each pair of LANs.

Switches also flood what type of Ethernet frame?

Switches also flood LAN broadcast frames (frames destined to the Ethernet broadcast address of FFFF.FFFF.FFFF) because this process helps deliver a copy of the frame to all devices in the LAN.

Switches compare the frame's destination MAC address to what when deciding whether to forward or ignore and drop the frame?

The switch will compare a destination MAC address to its local MAC table. If it has an entry, it will send that frame out its mapped switch interface. Then, for every other entry, it will simply ignore that interface and not forward the Ethernet frame.

What happens if a MAC table entry already exists, and it receives a new Ethernet frame with the same MAC address?

The switch will reset the inactivity timer back to 0 for that entry, and start the 300 second countdown all over again.

If a switch fills its entire MAC table, and new entries come in, what happens?

The switch will then remove the oldest table entries. The MAC address table uses CAM, a physical memory that has great table lookup capabilities. However, the table depends on the size of the CAM in a particular model of switch.

True or False? STP behaves identically for a transparent bridge and a switch?

True. Therefore, the terms bridge, switch, and bridging device are all used interchangeable when discussing STP.

What mode do you have to be in to utilize (clear) commands, such as (clear mac address-table dynamic)?

You have to be in privileged EXEC mode to use (clear) commands. This is because the (clear) command can be user disrupting, and user disrupting commands reside in privileged mode.

If you want to see the status for a single interface, you can do so in a couple ways. What commands would you run to view the status of interface F0/1?

a. (show interfaces f0/1 status) lists the status in a single line of output. b. (show interfaces f0/1) command (without the status keyword) displays a detailed set of messages about the interface.

Which of the following statements describes part of the process of how a switch decides to forward a frame destined for a known unicast MAC address? a. It compares the unicast destination address to the bridging, or MAC address, table. b. It compares the unicast source address to the bridging, or MAC address, table. c. It forwards the frame out all interfaces in the same VLAN except for the incoming interface. d. It compares the destination IP address to the destination MAC address. e. It compares the frame's incoming interface to the source MAC entry in the MAC address table.

a. It compares the unicast destination address to the bridging, or MAC address, table.

Which of the following statements best describes what a switch does with a frame destined for an unknown unicast address? a. It forwards the frame out all interfaces in the same VLAN except for the incoming interface. b. It forwards the frame out the one interface identified by the matching entry in the MAC address table. c. It compares the destination IP address to the destination MAC address. d. It compares the frame's incoming interface to the source MAC entry in the MAC address table.

a. It forwards the frame out all interfaces in the same VLAN except for the incoming interface.

What command(s) would you use to erase the startup configuration, VLAN configuration, to restart the switch, and to configure the hostname?

a. Use the (erase startup-config) EXEC command to erase the startup-config file. b. Use the (delete vlan.dat) EXEC command to delete the VLAN configuration details. c. Use the (reload) EXEC command to reload the switch (thereby using the empty startup-config, with no VLAN information configured.) d. Configure the (hostname SW1) command to set the switch hostname to SW1.

Which of the following comparisons does a switch make when deciding whether a new MAC address should be added to its MAC address table? a. It compares the unicast destination address to the bridging, or MAC address, table. b. It compares the unicast source address to the bridging, or MAC address, table. c. It compares the VLAN ID to the bridging, or MAC address, table. d. It compares the destination IP address's ARP cache entry to the bridging, or MAC address, table.

b. It compares the unicast source address to the bridging, or MAC address, table.

Which of the following statements describes part of the process of how a LAN switch decides to forward a frame destined for a broadcast MAC address? a. It compares the unicast destination address to the bridging, or MAC address, table. b. It compares the unicast source address to the bridging, or MAC address, table. c. It forwards the frame out all interfaces in the same VLAN except for the incoming interface. d. It compares the destination IP address to the destination MAC address. e. It compares the frame's incoming interface to the source MAC entry in the MAC address table.

c. It forwards the frame out all interfaces in the same VLAN except for the incoming interface.

A Cisco Catalyst switch has 24 10/100 ports, numbered 0/1 through 0/24. Ten PCs connect to the ten lowest numbered ports, with those PCs working and sending data over the network network. The other ports are not connected to any device. Which of the following answers lists facts displayed by the (show interfaces status) command? a. Port Ethernet 0/1 is in a connected state. b. Port Fast Ethernet 0/11 is in a connected state. c. Port Fast Ethernet 0/5 is in a connected state. d. Port Ethernet 0/15 is in a not connected state.

c. Port Fast Ethernet 0/5 is in a connected state.

Note: The forwarding choice by a switch was formerly called a ___ - ___ - ___ decision, because the switch also chooses to not forward (to filter) frames, not sending the frame out some ports.

forward-versus-filter

What command would you use to see a switch's MAC address table, and only Ethernet frames that were dynamically learned??

show mac address-table show mac address-table dynamic

Switches build the MAC address table by listening to incoming frames and examining the ___ MAC address in the frame?

source