In today’s computer networks, switches are super important. They help PCs talk to each other really well. Thus, switches use MAC addresses to send data packets.
In this article, we’ll look at how a switch works. We’ll see how they learn MAC addresses. Also, we’ll check out network packets using GNS3 and Wireshark.
How Do Switches Work in a Network and Learn Mac Addresses?
Switches are devices that we widely use in the network and provide data transfer according to MAC addresses.
These devices use the MAC address. In this way, it keeps all the devices you connect to them in its database. It also backs up your devices’ IP addresses. Therefore, Switches act according to the data in their table. So, it looks at its records for fast data transmission.
Let’s say there are two computers on the network. For example, PC1 pings PC2. When pinging, the ICMP protocol assigns source and destination IP addresses on the fly.
Then, since PC1 does not know PC2’s MAC record, it broadcasts a message to the LAN. The type of this message is Broadcast. It notifies the network using ARP (Address Resolution Protocol).
PC1 sets the target part to ff:ff:ff:ff:ff:ff for Broadcast. In short, PC1 asks who owns the IP address 192.168.5.10 using the ARP protocol. For this, ARP finds the device with 192.168.5.10. Then, in the next step, you perform the ping operation.
In our previous articles, we talked about what a switch is and the types of switching. Without going into further detail, I know you are knowledgeable about the relevant topics. So, now, let’s examine how this device learns MAC addresses on a network.
How to Examine the Operating Logic of a Switch using Wireshark in GNS3
Once we’ve set up a simple network using GNS3, we’ll ping from PC1 to PC2. But before we ping, we’ll use Wireshark to analyze the packets between PC1 and the Layer 2 Switch.
Please follow the steps below to examine how a Switch works.
Step 1
To begin with the GNS3 simulator, locate and open the software. After opening it, create a new project. Then, specify the project’s details in the new window.
Step 2
Add one Layer 2 Switch and two VPCS to the GNS3 workspace. For example, define an IP address block and add comments to the workspace.
Step 3
Assign IP addresses to VPCS computers. Later, use the show ip command in the command prompt to verify this action.
Step 4
The IP information on PC2 is as follows. In the meantime, remember the ethernet addresses of PC1 and PC2.
Step 5
Since there is no data transaction on the network, the ethernet address table on the Switch will be empty. To verify this, you can use the show mac address-table command to see the result.
Sometimes, computers send ARP Broadcasts. This helps them create their tables. Therefore, the Switch keeps MAC addresses in its cache for about 10 minutes. So, from now on, they no longer need to make ARP broadcasts to send more packets.
Step 6
To start Wireshark in GNS3, first, make a connection. Then, click “Start Capture” on that connection. This starts grabbing data packets so you can watch and analyze the network traffic.
Step 7
Click the “OK” button in the Packet Capture window to keep analyzing data.
Step 8
As soon as you press the OK button, the Wireshark program will automatically open. You will then see it start performing packet analysis in the image below.
Step 9
When you ping from PC1 to PC2, Wireshark captures ARP protocol activity.
Step 10
Click ARP Broadcast for more information. As in the image below, PC1 will broadcast to the target address ff:ff:ff:ff:ff:ff because it does not know the IP of PC2 yet.
Consequently, ARP Broadcast reaches the MAC of the PC with the IP 192.168.5.10. Now PC1 knows PC2’s ethernet address. As a result, you will see that ping (ICMP) starts without any problems.
Step 11
Review ARP address resolution by clicking column 25 in Wireshark. Also, note that the source and destination address spaces are PC1 and PC2.
Step 12
If the ping process is ok, then use the show mac address-table command on the Switch. Now, you will be able to see the device table here. As a result, you can see that the addresses PC1 and PC2 are in the table.
Step 13
If you want to delete table records, you can do this by using the clear mac address-table command.
Step 14
You can also see the address records on VPCS PC1 and PC2. You can use the show arp command to do this and the clear arp command to delete it.
Step 15
And finally, click on Stop Capture to close the Wireshark packet analysis program on GNS3.
How Does a Switch Find MAC Addresses? > Table
| Stages | Explanation |
|---|---|
| 1. Stage | This is the first time you have connected a device to a switch. At this point, the Switch has no information about that device. |
| 2. Stage | The device sends a frame to the current network with the source MAC address. |
| 3. Stage | The Switch gets the frame. It then checks the source address in the MAC address table. |
| 4. Stage | If the source address is not in the table, this time, it adds the frame with the port to the table. |
| 5. Stage | Let’s say the source address already exists in the table. The Switch then updates the port information for that MAC. |
| 6. Stage | The Switch receives a frame with the destination MAC address. And immediately, it looks up the target address in its table. |
| 7. Stage | If the destination address is in the table, it forwards the frame by forwarding it to the correct port. |
| 8. Stage | If it doesn’t find the destination in the table, it sends the frame to all ports except the one it got it from. |
| 9. Stage | As the devices communicate, they learn the association between IDs and ports. As a result, it updates the ID table accordingly. |
How Switch Works ⇒ Video
To learn how Switches learn MAC addresses, you might find the video below helpful. Also, if you want to support our work, please consider subscribing to our YouTube channel. Thanks!
Frequently Asked Questions About Switch Working Logic (FAQ)
- How does a Switch work in a network?
- How does a Switch do its job?
- How does a Switch send data?
- How do the Switches get on the Internet?
Conclusion
Think about setting up a Static address for better network performance. This cuts down on ARP Broadcasts and helps reduce congestion. You can also check the record table in Windows using the “arp -a” command.
To summarize, it is essential to really know how switches work in networks. They use MAC addresses to send data efficiently. Moreover, understanding how switches learn ethernet IDs helps with fixing problems and making things run better.
By using tools like Wireshark in simulated networks, admins can look at packets. This helps them understand how they work. Following good practices, like setting static records and keeping an eye on tables, makes sure everything runs smoothly.
TolgaBagci
Hi, I'm Tolga, a computer expert with 20 years of experience. I help fix computer issues with things like hardware, systems, networks, virtualization, servers, and operating systems. Check out my website for helpful info, and feel free to ask me anything. Keep yourself in the loop about the newest technologies!
