Ethernet

Why it exists

Every device on a shared medium hears everything. Addressing exists so a receiver can tell which frames are for it, and switching exists so that a frame does not have to reach every receiver in order to reach one. IEEE 802.3-2022 §3.1

A switch has no directory and nothing registers with it. It builds its forwarding table by reading the source address of every frame that arrives and remembering which port it came from — which means a host that never transmits cannot be found. IEEE 802.1D-2004 §7.8

Everything else at layer 2 is built on this. VLANs scope the learning, spanning tree stops the flooding looping, and both assume the switch is learning from traffic rather than being told.

A switch learns by listening, not by asking

Nothing tells a switch where a host is. It reads the source address of every frame that arrives and remembers the port it came in on.

How it works

A frame carries a destination and a source address. The switch looks the destination up in its filtering database to decide where to send it, and writes the source into that database against the port it arrived on. IEEE 802.1D-2004 §7.9

An unknown destination is flooded out every port in the VLAN except the one it arrived on. This is correct rather than a fallback: dropping it would make a silent host permanently unreachable. IEEE 802.1D-2004 §7.7

Entries age out after five minutes by default, refreshed by frames received *from* the address rather than sent to it. Silence and absence are indistinguishable to a switch, which is the root of unicast flooding. IEEE 802.1D-2004 §7.9.2

The same address arriving on a different port moves the entry immediately, with no verification. That is what makes migration and failover work, and what makes a loop present as an address flapping between two ports.

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. Ports that should be idle show steady inbound traffic, and a wireless network becomes slow while the wired one seems fine.

   Narrow it down

   1. Capture on an uninvolved port and check whether the traffic is addressed to somebody else.
   2. Compare the switch ageing time against the router ARP timeout.
   3. Look for an asymmetric conversation — one side sending constantly, the other rarely.

   Cause

   The quiet side aged out of the filtering database while the conversation was still running, so every packet toward it is an unknown unicast and is flooded.

   Fix

   Align the ageing time with the ARP timeout so the two expire together. Reducing VLAN size limits the damage but does not remove the cause.

   IEEE 802.1D-2004 §7.9.2

2. Log messages report a MAC address moving repeatedly between two ports, and connectivity in that VLAN is intermittent.

   Narrow it down

   1. Read the two ports named in the message — they bound the loop.
   2. Check whether spanning tree is running on both and whether either is an edge port.
   3. Look for a device bridging the two, often an unmanaged switch or a hypervisor.

   Cause

   A loop is delivering copies of the same host’s frames to two ports. The switch believes the most recent frame, so the entry oscillates.

   Fix

   Break the loop. Then find why spanning tree did not — a disabled instance, a BPDU filter, or a device that does not forward BPDUs.

3. A switch starts flooding all traffic, and its table is at capacity with addresses nobody recognises.

   Narrow it down

   1. Count the entries against the platform limit.
   2. Look at whether the addresses are plausible or random.
   3. Check which port they are being learned on.

   Cause

   The filtering database is full, so nothing new can be learned and everything unknown is flooded. Either the VLAN is genuinely too large, or a host is forging source addresses to force exactly this.

   Fix

   Port security limits how many addresses a port may learn, which caps the attack at one port. A large flat VLAN needs splitting rather than limiting.

4. A device is reachable only after something is sent from it, and unreachable again later.

   Narrow it down

   1. Check whether its address is in the table at all.
   2. Ping from the device and see whether it becomes reachable.
   3. Look at how often it transmits unprompted.

   Cause

   A switch learns only from transmitted frames. A device that listens and rarely sends is invisible until it does, and is forgotten again after the ageing time.

   Fix

   A static entry pins it. In practice most such devices are appliances that can be configured to send something periodically, which is the more maintainable answer.

5. A link is up and passes small traffic, and throughput collapses under load. One end reports collisions and the other reports errors.

   Narrow it down

   1. Compare the duplex setting reported at each end — they will differ.
   2. Look for late collisions on the half-duplex end, which is the specific signature.
   3. Check whether one end has speed and duplex forced and the other is auto-negotiating.

   Cause

   One end is half duplex and the other full. The half-duplex end defers and detects collisions; the full-duplex end transmits whenever it likes. Every simultaneous transmission is a collision one end sees and the other does not.

   Fix

   Auto-negotiate at both ends, or force both. Forcing one end is what causes this — a forced end sends no negotiation, so the auto end falls back to half duplex and the two disagree.

Design notes

Align the switch ageing time with the router ARP timeout. The default pairing — five minutes against four hours — guarantees a window where the router keeps sending to an address the switch has forgotten, and every packet in it is flooded.

A MAC flap message is a loop report. It names both ports involved, needs no spanning tree, and frequently arrives before anything else does. Treat it as the first thing to read when a VLAN misbehaves.

Table capacity is finite and much smaller than people expect on access switches. Filling it — by accident on a large flat VLAN, or deliberately with forged source addresses — makes the switch flood everything, which is the point of the attack.

Misconceptions

“A switch learns from the destination address.”

It learns from the source. The destination is looked up to decide where to forward; the source is what gets written to the table — which is why a switch learns about a host from a frame that was addressed to somebody else. IEEE 802.1D-2004 §7.8

“Flooding an unknown unicast is a failure.”

It is the correct behaviour and the only safe one. Dropping the frame would make any host unreachable until it happened to transmit. Flooding is a problem when it is continuous, not when it happens. IEEE 802.1D-2004 §7.7

“A switch is a fast hub.”

A hub repeats every frame to every port and shares one collision domain. A switch forwards to one port and gives each port its own, which is why full duplex became possible and why collisions effectively disappeared.

“A MAC address is burned in and cannot change.”

It is assigned in manufacturing and freely overridable in software. Virtual machines, bonded interfaces and privacy features all set their own, and the switch has no way to know or care.

More walkthroughs

Terms

Filtering database

A switch’s table of MAC addresses and the ports they were last seen on. Built entirely by reading the source address of arriving frames; nothing registers with it.

Flooding

Sending a frame out every port in the VLAN except the one it arrived on. The correct response to a destination the switch has not learned.

Unknown unicast flooding

Flooding traffic addressed to a specific host because its entry has aged out. Harmless once; a continuous stream when one side of a conversation talks and the other rarely answers.

Check yourself

• Which address does a switch use to populate its filtering database?

  • The destination address
  • The source address of every frame that arrives
  • Both, equally
  • Neither; hosts register with the switch
• What does a switch do with a unicast frame whose destination it has not learned?

  • Drops it
  • Floods it out every port in the VLAN except the ingress port
  • Sends it to the default gateway
  • Buffers it until the address is learned
• What refreshes a filtering database entry?

  • Frames sent to that address
  • Frames received from that address
  • Either direction
  • A periodic keepalive from the host
• A log reports one MAC address moving between two ports several times a second. What does that indicate?

  • A virtual machine migrating
  • A layer 2 loop delivering the same frames to both ports
  • A duplicate IP address
  • A failing cable
• What did switching change that hubs could not do?

  • Higher link speeds
  • Per-port collision domains, which made full duplex possible
  • Longer cable runs
  • VLAN support
• A device is plugged in, powered, and does not appear in the MAC address table. What is the most likely reason?

  • The cable is faulty
  • It has not transmitted anything — a switch cannot learn about a silent host
  • The VLAN is wrong
  • The port is blocked by spanning tree
• How does a switch tell a broadcast or multicast frame from a unicast one?

  • By the EtherType
  • By the low bit of the first octet of the destination address — the group bit
  • By the frame length
  • By whether the source is in its table
• An EtherType of 0x8100 appears in a capture. What follows it?

  • An IPv4 header
  • A VLAN tag, with the real EtherType four octets further on
  • An MPLS label stack
  • The frame check sequence

Related

• STP

  Keeps a switched network free of loops by disabling just enough ports to leave one active path between any two bridges.

• VLANs

  Splits one physical switched network into several independent broadcast domains, and carries them over a shared link with a four-octet tag.

• ARP

  Finds the MAC address behind an IPv4 address on the local segment, by asking everyone and trusting whoever answers.