Ethernet Switches: Learning, Flooding, Forwarding, and VLAN Fundamentals
What a Switch Does
A switch is a link-layer device: it receives link-layer frames and forwards them onto outgoing links according to their destination MAC addresses. A switch is transparent to hosts and routers: a host addresses a frame only to the destination node's MAC address and is unaware that a switch sits in between. Every switch interface has buffers, so when several frames need to leave the same interface at once, they wait in a queue.
At the heart of a switch is its switch table. Each entry records a MAC address, the switch interface leading toward that address, and the time the entry was written.
Filtering and Forwarding
Filtering decides whether a frame should be forwarded or dropped; forwarding decides which interface the frame should leave on. Suppose a frame with destination address DD arrives at the switch on interface . The switch looks up DD:
| Case | What the switch does |
|---|---|
| DD is not in the table | Flooding: forward the frame out of every interface except |
| DD maps to interface itself | Filtering: the destination is on the same segment as the sender and has already received the frame, so the switch discards it |
| DD maps to another interface | Forwarding: put the frame only in interface 's output buffer |
Frames sent to the broadcast address are always flooded.
Self-Learning
The switch table is built automatically rather than configured by an administrator, which makes switches plug-and-play devices:
- The switch table starts empty.
- For every frame it receives, the switch records the frame's source MAC address, the interface the frame arrived on, and the current time. As long as every host on the LAN eventually sends a frame, the switch learns where every host is.
- If an entry is not refreshed within a period (the aging time, say 300 seconds), the switch deletes it. This keeps the table correct when hosts move or adapters are replaced.
Teach a switch by sending frames
Unlock the complete interactive lab, deeper explanations, and curated reference answers.
KNOWLEDGE QUIZ
Switches versus Routers
Switches and routers are both store-and-forward packet switches, but they work at different layers, each with its pros and cons:
| Aspect | Switch | Router |
|---|---|---|
| Layer | Link layer, forwards by MAC address | Network layer, forwards by IP address |
| Configuration | Plug-and-play, self-learning | Needs IP addresses and routing protocols configured |
| Topology | The active topology must be a spanning tree, or broadcast frames would loop forever | Loops are allowed; routing protocols choose the best path |
| Broadcasts | Forwards broadcast frames; broadcast storms are possible in large networks | Isolates broadcasts, acting as a broadcast "firewall" |
| Processing | Handles only layer 2, so forwarding is fast | Must process layer 3, at greater cost |
So a small network of a few hundred hosts usually needs only switches, while larger networks deploy routers on top of switches to isolate broadcasts and provide smarter routing.
Compared with a hub, every switch interface is its own collision domain. Full-duplex links never see collisions, and nodes on different interfaces can all send at the full link rate at the same time, which is why switches replaced hubs.
Virtual LANs (VLANs)
If every department of a large institution is connected to one switched network, several problems arise: every broadcast frame (such as ARP and DHCP messages) travels across the whole network, wasting bandwidth and creating security and privacy concerns; yet giving each department its own switches leaves them poorly utilized and forces rewiring whenever an employee changes departments.
A switch that supports VLANs (virtual local area networks) lets multiple virtual LANs be defined over one physical LAN. In a port-based VLAN, the network administrator divides the switch's ports into groups. Each group is a VLAN and forms a separate broadcast domain: broadcast frames are delivered only to ports in the same VLAN. Moving a host to another VLAN only requires changing the port configuration on the switch, with no rewiring. Traffic between different VLANs must be forwarded by a router.
When VLANs span several switches, the switches can be joined by a trunk link that belongs to every VLAN. So that the switch at the other end knows which VLAN a frame belongs to, frames sent on a trunk carry a 4-byte IEEE 802.1Q tag:
| Field | Length | Meaning |
|---|---|---|
| TPID | 16 bits | Always 0x8100, marking the frame as VLAN-tagged |
| Priority (PCP) | 3 bits | The frame's priority, for quality of service |
| DEI | 1 bit | Whether the frame may be dropped first under congestion |
| VLAN ID | 12 bits | The VLAN the frame belongs to; usable values are 1–4094 |
The tag is added by the sending switch and removed by the receiving switch, so hosts still see ordinary Ethernet frames. Because inserting the tag changes the frame's contents, the switch must also recompute the CRC.
Split one switched network into VLANs
Unlock the complete interactive lab, deeper explanations, and curated reference answers.
KNOWLEDGE QUIZ
Count collision domains and broadcast domains
Router R connects switch S1 and switch S2. H1–H3 connect directly to S1, H4 and H5 connect to S1 through a hub, and H6–H9 connect directly to S2. All links are full duplex except those on the hub.
- How many collision domains are there?
- How many broadcast domains are there?
- The hub is replaced by a switch. How do the answers change?
- Instead, H6 and H7 are put in VLAN 10 and H8 and H9 in VLAN 20 on S2 (with the hub restored). Now how many broadcast domains are there?
Simulate a self-learning switch in Python
Hosts A, B and E are on switch ports 1, 2 and 4; C and D share port 3 through a hub. Write a Python function receive(now, src, dst) that ages out entries older than 300 s, learns the source, and returns the action (flood, forward, or filter) and the output ports. Run it on the frames (0, A→E), (1, E→A), (2, C→D), (3, D→C), (4, B→A), (400, B→E) and print the table after each frame.