Ethernet LAN Switching (Part 2) Day 6

• Ethernet frames consist of a preamble, Start Frame Delimiter (SFD), destination, source, and type fields
• The Ethernet header + trailer is 18 bytes in size, excluding the preamble and SFD
• The minimum size for an Ethernet frame is 64 bytes, with a minimum payload size of 46 bytes
• If the payload of an Ethernet frame is less than 46 bytes, padding bytes (0s) are added to meet the minimum payload size
• Address Resolution Protocol (ARP) is used to discover the MAC address of a known IP address in a network
• ARP process involves an ARP request (broadcast) and an ARP reply (unicast) to obtain MAC addresses
• ARP request frames use the broadcast MAC address (FFFF.FFFF.FFFF) to request MAC address information from other devices on the network
• ARP reply frames are unicast frames sent directly to the requesting device with the MAC address information
• Switches learn MAC addresses dynamically when they receive frames and associate them with the port the frame was received on
• SW2 learns MAC addresses and enters them into the MAC address table
• SW2 forwards known unicast frames out of the interface in the MAC address table
• SW2 does not flood known unicast frames or broadcast frames
• PC1 uses the information from the ARP reply to add an entry for PC3 to its ARP table
• ARP tables store IP address to MAC address associations
• The ARP table displays IP addresses in the Internet address column and corresponding MAC addresses in the Physical address column
• Entries in the ARP table can be static or dynamic
• Dynamic entries in the ARP table are learned by sending an ARP request and receiving an ARP reply
• Ping is a network utility used to test reachability between computers
• Ping measures the round-trip time using ICMP Echo request and ICMP Echo reply messages
• ARP must be used before sending a ping to know the MAC address of the destination host
• The ping command format is 'ping' followed by the IP address of the destination host
• Ping sends ICMP Echo requests and expects ICMP Echo replies
• Wireshark is used to perform packet captures and analyze network traffic
• Wireshark displays the Protocol column showing the type of traffic, such as ARP and ICMP
• ARP requests are broadcast to find the MAC address of a specific IP address
• ARP replies provide the MAC address corresponding to the IP address
• ICMP Echo requests and replies are used in the ping process
• The MAC address table on a Cisco switch can be viewed using the command 'show mac address-table'
• The MAC address table includes VLAN, MAC address, type, and ports (interfaces)
• Dynamic MAC addresses are removed from the MAC address table after 5 minutes, a process known as aging
• If a switch doesn't receive any traffic from a MAC address for 5 minutes, it will remove the entry from the MAC address table
• MAC addresses can also be manually removed from the table
• The command "clear mac address-table dynamic" clears all dynamic MAC addresses from the table
• To clear specific MAC addresses from the table, additional options can be added to the command
• The command "clear mac address-table dynamic address" followed by the MAC address clears that specific address from the table
• Another option to clear the MAC address table is "clear mac address-table dynamic interface [interface]", which clears all entries for a specific interface