Professor Messer 2.3 | Network Switching Overview

The Switch

Forwards or drops frames based on the destination MAC address, while continually updating a list of MAC addresses by recording the source MAC of incoming traffic. It maintains a loop-free network environment using Spanning Tree Protocol (STP).

Frame switching

Involves sending Ethernet frames through a switch network, where every frame follows the same process. When Sam sends data to the SGC server, identified by its MAC address (1000:5555:5555), the switch checks its MAC address table. This table maps each MAC address to the corresponding interface. If the server's MAC address matches an entry in the table, the switch forwards Sam's traffic through the correct interface, directing it to the server.

Frame switching between switches:

The frame switching process occurs on each switch individually. For example, if Sam sends data to the SGC server with the MAC address 1000:5555:5555, the process involves both switches. Switch A first looks up the destination MAC address in its table, finds it associated with the gigabit 0/2 interface, and forwards the traffic to Switch B. Switch B then performs a similar lookup, finds the MAC address associated with its fast Ethernet 0/5 interface, and sends the traffic to the server. Each switch maintains its own MAC address table and processes the traffic independently.

Learning

To build its MAC address table, a switch examines all incoming traffic and records the source MAC addresses. Unknown MAC addresses are added to the table, and the switch sets the output interface to the one where the traffic was received.

For example, when a switch is first powered on and receives traffic from Sam’s computer with the source MAC address 1000:1111:1111 via interface F0/1, it records this information in its MAC address table. The switch then forwards the traffic to the SGC server. When the SGC server responds with its own source MAC address, the switch updates its table again, noting that this MAC address is associated with interface F0/5.

Flooding for unknown MACs:

When a switch encounters a MAC address not in its table, it floods the network with the traffic, sending it to all devices. For instance, if the SGC server responds to Sam and the server's MAC address is not yet in the table, the switch adds the server's MAC address to its table. Future communications between Sam and the SGC server won’t require flooding, as the switch will now direct traffic appropriately.

A MAC flooding attack, or MAC table overflow attack, involves sending a large number of fake MAC addresses to overwhelm the switch's MAC address table, causing it to flood all traffic to all ports, disrupting network performance and security.

Address Resolution Protocol (ARP)

Queries the network to find the MAC address corresponding to a specific IP address. This hardware address is necessary for direct communication. You can view the local ARP table using the command arp -a.

When you use the ping command, it first triggers an ARP request to locate the device with the specified IP address. Once an ARP response is received, the device’s MAC address is known, allowing for direct traffic communication.

Neighbor Discovery Protocol (NDP)

Replaces ARP in IPv6, as IPv6 does not use broadcasts. Handles Neighbor MAC Discovery, allowing devices to find each other's MAC addresses. It also supports Stateless Address Autoconfiguration (SLAAC), which lets devices automatically configure their IP addresses without a DHCP server. Additionally, includes Duplicate Address Detection (DAD) to ensure that no two devices have the same IP address.

Howdy, neighbor

To find a device's MAC address, a Neighbor Solicitation (NS) message is sent as a multicast. The targeted device responds with a Neighbor Advertisement (NA) message, providing its MAC address.

Power over Ethernet (PoE)

Allows power to be delivered over an Ethernet cable along with network data. This is useful for devices like phones, cameras, and wireless access points, especially in hard-to-reach locations. Power can be supplied directly from the switch, known as Endspans, or via an inline power injector, called Midspans, which adds power to an existing Ethernet cable.

Operates in two modes:

Mode A: Power is sent over the same data pairs used for gigabit Ethernet connections, allowing both data and power to travel on the same wires.

Mode B: Power is sent over the spare pairs in the cable, used for 10/100 Mbps connections where some wires are available for power without affecting data transmission.

PoE: IEEE 802.3af-2003

Defines the original Power over Ethernet (PoE) specification. It is now part of the 802.3 standard and provides up to 15.4 watts of DC power with a maximum current of 350 mA.

POE+: IEEE 802.3at-2009

Is an updated PoE specification now included in the 802.3 standard. It provides up to 25.5 watts of DC power with a maximum current of 600 mA.