What a switch does with a frame
A switch is a layer 2 device with many ports, and it makes one decision per frame: which port should this go out of? It answers using a forwarding table also called a MAC address table or CAM table, which maps a MAC address to a port.
Nobody configures that table. The switch learns it with two rules.
1. Learn from the source. Every frame arriving on port 3 with source MAC
aa:11 teaches the switch that aa:11 lives on port 3. Write it down with a
timer, usually 300 seconds.
2. Flood the unknown. If the destination MAC is not in the table, or is the
broadcast address, send the frame out of every port except the one it came
in on. Somebody will answer, and that answer teaches the switch where the
destination lives.
So a switch starts knowing nothing and becomes precise after one frame in each direction. Compare it with the device it replaced, a hub, which had no table and simply repeated every frame to every port forever.
| Hub | Switch | |
|---|---|---|
| Decision | none, repeat everywhere | per frame, by MAC |
| Collision domain | one, shared by all ports | one per port |
| Simultaneous conversations | one | many, at full speed |
| Layer | 1 | 2 |
Collision domains and broadcast domains
Two scopes get confused constantly, so separate them now.
- A collision domain is the set of interfaces that can interfere with each
other's transmissions. On a modern switch each port is its own collision
domain, so this term is mostly historical on wires.
- A broadcast domain is the set of interfaces that receive a frame sent to
ff:ff:ff:ff:ff:ff. A switch extends the broadcast domain, because it
floods broadcasts out every port. A router ends it, because a router
never forwards a layer 2 broadcast.
Broadcast domain size is the practical limit on how big a flat network can be. Every host's ARP requests, DHCP discoveries, and discovery chatter reach every other host, and each host's CPU has to look at each one. A few hundred hosts is comfortable. A few thousand in one broadcast domain produces a network that mostly talks about itself.
One more hazard worth naming. If you cable two switches together twice, a broadcast loops forever and gets flooded again on every pass, which saturates every link in seconds. That is a broadcast storm, and the protocol that prevents it is STP (spanning tree protocol). STP has switches elect a root, compute the shortest loop free tree, and deliberately put the redundant ports into a blocking state until they are needed.
VLANs: many broadcast domains on one switch
A VLAN (virtual LAN) splits one physical switch into several independent broadcast domains, identified by a 12 bit VLAN ID from 1 to 4094. Ports in VLAN 10 behave as if they were on a completely separate switch from ports in VLAN 20. Traffic between them must go through a router, exactly like traffic between two physical networks.
Two port roles exist:
| Role | Carries | Frames |
|---|---|---|
| Access port | one VLAN | untagged, the host has no idea |
| Trunk port | many VLANs | tagged with a 4 byte 802.1Q header |
The 802.1Q tag is inserted after the source MAC and holds the VLAN ID, which is why a tagged frame can reach 1522 bytes instead of 1518. Hosts normally never see tags. The switch adds the tag when a frame leaves on a trunk and strips it when the frame lands on an access port.
Why bother? Three reasons that hold up in practice:
1. Segmentation without new hardware. Guest Wi-Fi, badge readers, and finance workstations can share one switch and still not see each other. 2. Smaller broadcast domains. Chatter stays inside its own VLAN. 3. Policy at one place. Because inter VLAN traffic must pass the router, a single firewall rule set governs it.
The cloud version of this idea is a VPC subnet, and Lesson 6-3 comes back to it. The concept is identical, a bounded broadcast scope with a router in front.