Ethernet, Switches & VLANs
Below IP there is Ethernet: MAC addresses, a switch that learns where everyone lives, and VLANs that split one switch into many.
An interactive Networking lesson: 18 steps, about 30 minutes, on a live simulation in your browser.
Three desks, pc1, pc2 and pc3, plugged into one switch. No router, no gateway. pc1 pings 192.168.1.11 for the first time.
The ping is not the first packet. pc1 knows the IP address but not the hardware address behind it, so it broadcasts an ARP request to everyone: who has 192.168.1.11? Only pc2 answers, with a unicast reply, and pc1 caches the answer.
What you will learn
The wire
- Three machines, one wire
- Every card has a MAC: The IP header names the final destination. The Ethernet header names only the next stop on this wire.
- The first packet is not the ping
Learn, flood, forward
- Flood, then forward: A broadcast is flooded to every port. A frame for a known MAC is forwarded out of exactly one port.
- The switch learns: A switch learns MAC-to-port from every frame's source address, and floods whatever it has not learned yet.
- Flood or forward?
- Break it: unplug a machine
Broadcasts
- Everyone hears a broadcast: Everyone on a LAN receives every broadcast. A broadcast domain is the set of machines one broadcast reaches.
- Drill: ask who-has
Splitting the LAN
- One switch, two LANs: A VLAN splits one switch into many virtual ones. Broadcasts never cross the split; neither do unknown unicasts.
- Access vs trunk: Hosts sit on access ports and never see a tag. Switches join by trunks, which tag every frame with its VLAN.
- Who hears it now?
Tags and trunks
- Tags on the trunk: The 802.1Q tag is four bytes a trunk adds and an access port removes. Twelve bits of VLAN id: 1 to 4094.
- Break it: the wrong VLAN
- Drill: show the VLAN table
- Two ways VLANs leak: A VLAN is only as tight as its ports. Mismatched native VLANs and promiscuous trunks undo the split.
Recap & playground
- Cheat sheet
- Playground