Computer Networking Cheatsheet

Ethernet and Switching

Use this Computer Networking reference while you build software engineering projects, review code, or refresh the syntax you reach for most.

MAC addresses

48 bits, written as six hex bytes. The first three bytes are the OUI (organizationally unique identifier, the vendor), the last three are assigned by that vendor.

  b8:27:eb : 4a:1c:7f
  \______/   \______/
    OUI       NIC
  Raspberry   serial

Two bits in the first byte carry meaning:

Bit	Name	0 means	1 means
least significant of byte 0	I/G	unicast	multicast group
second least significant	U/L	globally unique (OUI)	locally administered

ff:ff:ff:ff:ff:ff is broadcast. 01:00:5e:... is IPv4 multicast, 33:33:... is IPv6 multicast. Randomized Wi-Fi MACs set the U/L bit, which is why they never match a vendor lookup.

Ethernet II frame layout

+----------+---------+---------+-----------+----------------+-----+
| Preamble | Dst MAC | Src MAC | EtherType |    Payload     | FCS |
|  8 bytes |    6    |    6    |     2     |    46-1500     |  4  |
+----------+---------+---------+-----------+----------------+-----+
                              802.1Q tag inserts 4 bytes here

EtherType	Protocol
`0x0800`	IPv4
`0x0806`	ARP
`0x86DD`	IPv6
`0x8100`	802.1Q VLAN tag
`0x88A8`	802.1ad QinQ
`0x8847`	MPLS unicast
`0x8863` / `0x8864`	PPPoE discovery / session

Minimum frame is 64 bytes including FCS, so short payloads get padded. Maximum untagged frame is 1518 bytes, and 1522 with a VLAN tag.

How a switch learns

A switch is a layer 2 device with one collision domain per port. It builds a MAC address table (also called the CAM table) mapping MAC → port.

1. A frame arrives on port 3 with source aa:bb:cc:00:00:01. The switch records aa:bb:cc:00:00:01 → port 3 with an aging timer, 300 s by default on Cisco. 2. The switch looks up the destination MAC. 3. Known unicast: forward out that one port. 4. Unknown unicast, broadcast, or multicast: flood out every port in the VLAN except the one it arrived on. 5. The destination replies, the switch learns its port, and the conversation stops flooding.

bridge fdb show                    # Linux bridge forwarding database
bridge fdb show br br0
ip -s link show dev eth0           # per-interface counters, errors, drops

Cisco equivalents: show mac address-table and show interfaces status.

Hub vs switch vs router vs L3 switch

Device	Layer	Forwards on	Collision domains	Broadcast domains
Hub	1	nothing, repeats bits	1 shared	1
Bridge · switch	2	destination MAC	1 per port	1 per VLAN
L3 switch	2 and 3	MAC in VLAN, IP between	1 per port	1 per VLAN, routes between
Router	3	destination IP	1 per port	1 per interface
Firewall	3, 4, 7	policy on flows	per port	per interface

The line to remember: switches separate collision domains, routers separate broadcast domains.

Duplex, autonegotiation, and speed

Modern links autonegotiate. A duplex mismatch (one side full, one side half) still happens when someone hardcodes one end, and it shows up as a link that works at low load and collapses under load, with late collisions and CRC errors on the counters.

ethtool eth0                       # speed, duplex, link, advertised modes
ethtool -S eth0 | grep -iE 'err|drop|crc'
ethtool -s eth0 speed 1000 duplex full autoneg on
ip link set eth0 up
ip link show eth0                  # LOWER_UP means carrier is present

Counter climbing	Usual cause
CRC / FCS errors	bad cable, bad SFP, duplex mismatch
Late collisions	duplex mismatch
Input drops	ring buffer too small, CPU starved
Carrier transitions	flapping link, dying transceiver

Spanning tree, link aggregation, and loops

A layer 2 loop has no TTL to stop it, so one miswired cable can broadcast storm a whole VLAN into an outage.

STP (802.1D, then RSTP 802.1w, then MSTP 802.1s) elects a root bridge by lowest bridge ID and blocks redundant ports until they are needed.

Port state (RSTP)	Meaning
Discarding	drops frames, the loop-free guard
Learning	builds the MAC table, no forwarding
Forwarding	normal operation

Port roles: root port (best path to the root), designated port (forwards on a segment), alternate and backup (blocked standby).

LACP (802.3ad) bundles several physical links into one logical link for bandwidth and failover. It hashes each flow onto one member link, so a single TCP connection never exceeds one member's speed.

# Linux bond in LACP mode
ip link add bond0 type bond mode 802.3ad
ip link set eth1 master bond0
ip link set eth2 master bond0
cat /proc/net/bonding/bond0        # member state, LACP partner info