§6.4.3Switched LANs · Link-Layer Switches

Link layer Kurose & Ross pp. 491–497 · ~12 min read

  • switch table
  • self-learning
  • filtering
  • aging time

Where you are

  • Application layer
  • Transport layer
  • Network layer
  • Link layer you are here
  • Physical layer

A switch fills its own forwarding table by reading the source address of every frame that passes through it, and needs no administrator to do so.

Words you will meet

  • Switch table — an address, the interface leading to it, and the time it was learned.

  • Self-learning — the table is built automatically, dynamically and autonomously.

  • Filtering — dropping a frame because the destination is where it came from.

  • Aging time — how long an entry survives without a frame to refresh it.

  • Plug-and-play — nothing to configure, ever.

  • Hub — a physical-layer repeater, with no table and no idea what a frame is.

Why this matters

Section 6.4.1 assumed something and admitted it: “we will assume in this section that the switch broadcasts all frames”. This page removes that assumption.

A switch that broadcast everything would give you a hub with extra steps. What makes a switched LAN (Local Area Network) worth having is that it usually does not broadcast.

The interesting question is how it knows enough not to, given that nobody ever tells it anything.

Three cases, decided from the destination

A frame arrives at the switch on interface x, addressed to DD-DD-DD-DD-DD-DD. The switch looks that address up in its table, and there are exactly three possibilities.

A frame arrives for DD-DD-DD-DD-DD-DD on interface x
No entry in the tablestep 1 of 3
switchin, if xevery interface except x

The switch has never seen a frame FROM this address, so it has no idea where the destination is. It forwards a copy to every interface except x. In other words, it broadcasts — and that is what a switch does when it does not know.

Read all steps as text
  1. No entry in the tableThe switch has never seen a frame FROM this address, so it has no idea where the destination is. It forwards a copy to every interface except x. In other words, it broadcasts — and that is what a switch does when it does not know.
  2. An entry, pointing at interface x itselfThe destination is on the very segment the frame came from, so it has already been heard there. Forwarding it anywhere would be waste. The switch discards it — this is the filtering function.
  3. An entry, pointing at some other interface yThe switch puts the frame in the output buffer for interface y, and nowhere else. This is the forwarding function, and it is why a switched LAN wastes so little: as long as the table is complete and accurate, nothing is ever broadcast.

The book walks two of these through its own Figure 6.22.

Figure 6.22 — a portion of the uppermost switch’s table
AddressInterfaceTime

Cells marked ⓘ have an explanation — click to read it.

Three columns, and every one of them is filled in by the switch itself.

A frame for 62-FE-F7-11-89-A3 arriving on interface 1 is filtered: the table says the destination is out that way, so it has already been heard. The same frame for the same destination arriving on interface 2 is forwarded, to interface 1 only.

Same address, same table, opposite outcomes. The interface it arrived on decides.

In plain words

As long as the table is complete and accurate, the switch sends frames towards their destinations without any broadcasting at all.

That is the whole difference from a hub, and the book puts it plainly: a switch is “smarter” than a hub.

But nobody configures that table

So where does it come from? Is there a link-layer equivalent of the routing protocols in chapter 5? Must an overworked administrator type it in?

Neither. The table is built automatically, dynamically and autonomously, and the procedure has three steps.

  1. The switch table starts empty.
  2. For every incoming frame, the switch stores the source address, the interface it arrived on, and the current time.
  3. An address is deleted if no frame arrives with that address as its source for the aging time.

In plain words

Read steps 2 and 3 again and notice which address they name.

A switch learns from the source address and decides from the destination address. Both happen to the same frame, in that order, and they are never the same lookup.

It makes sense once you say it aloud: a frame arriving from somewhere is evidence about where its sender is. It is no evidence at all about where the receiver is.

Feed the switch and watch its table build

Switch table — 0 entries

AddressInterfaceTime
empty — a switch starts knowing nothing

An entry is deleted when no frame has arrived with that address as its source for 60 minutes.

Frames sent

Send one frame, then send one back the other way. The second is the interesting one.

Send a frame from one host to another, then send one back the other way. The second frame is where the idea lands: it is forwarded on one interface only, because the first frame taught the switch where the sender was.

The clock advances one minute per frame so the times stay readable. Aging is applied on every frame, but you would need to send 60 frames to see an entry expire — the book’s own 60-minute example is in the walk-through below instead.

Send one frame and then send one back the other way. The first must be broadcast, because the destination is unknown. The second is forwarded on a single interface — the reply is cheap because the question paid for it.

The book’s own worked example

At 9:39 a frame with source address 01-12-23-34-45-56 arrives from interface 2, and that address is not yet in the table. So the switch adds a row: the address, interface 2, and the time. That is Figure 6.23.

Now the aging. The entry for 62-FE-F7-11-89-A3 was placed at 9:32. Suppose the aging time is 60 minutes and no frame with that source address arrives between 9:32 and 10:32.

At 10:32 the switch removes the address from its table.

Everyday picture

A receptionist who never gets a staff list. Every time somebody walks out of a corridor, the receptionist notes which corridor they came from. Ask for that person later and the receptionist knows where to point.

Nobody wrote the list. It was assembled from watching, and the entries fade if a person is not seen for an hour.

Where the picture stops. A receptionist would remember a name they merely overheard. A switch will not: it records only who walked out, never who was asked for. That is the source-versus-destination asymmetry, and the widget above marks each new row so you can watch it hold.

Switches are also full-duplex — any interface can send and receive at the same time.

What switching buys, and what it costs

Three advantages, from the book.

Collisions are eliminated. In a LAN built from switches and without hubs, no bandwidth is wasted on collisions at all. The switch buffers frames and never transmits more than one on a segment at a time. Maximum aggregate throughput is the sum of every interface rate.

Links can be heterogeneous. A switch isolates one link from another, so different links can run at different speeds over different media. One switch might carry three 1 Gbps copper links, two 100 Mbps fibre links and one 100 Mbps copper link. It is ideal for mixing old equipment with new.

Management gets easier. A jabbering adapter that transmits endlessly can be detected and internally disconnected, so nobody has to drive back to work at night. A cut cable disconnects only the host on it. In the days of coaxial cable a single break brought down the whole network, and a manager spent hours crawling the floor to find it.

Table 6.1 — hubs, routers and switches
Hubphysical layerSwitchlink layerRouternetwork layer
Traffic isolationTable 6.1
Plug and playTable 6.1
Optimal routingTable 6.1
How far up does it read?

Cells marked ⓘ have a reason behind them — click to read it.

The book’s own three-row comparison, with a fourth row added for the layer each device works at. Click any cell.

The costs are real too. A switched network’s active topology is restricted to a spanning tree, so redundant links exist but cannot be used. A large switched network needs large ARP (Address Resolution Protocol) tables and generates substantial ARP traffic. And a switch is vulnerable to a broadcast storm : one host transmitting an endless stream of broadcast frames will have every switch faithfully forward them until the network collapses.

A router is immune to that last one, because it does not forward layer-2 broadcasts at all.

Switch poisoning

Because a switch broadcasts frames whose destination is not in its table, an attacker does not need to break the switch to listen. They need only make it forget.

Switch poisoning floods the switch with packets carrying many different bogus source addresses. The table fills with rubbish and has no room left for the legitimate hosts — so the switch falls back to broadcasting, and a sniffer hears everything.

Note which field the attack exploits: the source address, the one the switch trusts without checking. Nothing verifies that a frame’s source address belongs to the host that sent it.

So when do you use which?

Small networks of a few hundred hosts have a few LAN segments, and switches are enough: they localise traffic and raise aggregate throughput with no IP (Internet Protocol) configuration at all.

Larger networks of thousands of hosts put routers inside the network, along with switches. Routers isolate traffic more robustly, contain broadcast storms, and choose more intelligent paths.

Check yourself

Check yourself

0 of 7 answered
  1. 1.Which address does a switch put into its table, and which does it look up?

  2. 2.predictA frame for 62-FE-F7-11-89-A3 arrives on interface 1. The table says that address is on interface 1. What does the switch do?

  3. 3.predictA switch has just been plugged in, so its table is empty. Host A sends a frame to host B, then B replies to A. How is each frame handled?

  4. 4.predictAn entry was placed at 9:32 and the aging time is 60 minutes. No frame carries that source address afterwards. When is it removed?

  5. 5.Table 6.1 gives switches Yes for traffic isolation and plug-and-play, but No for optimal routing. Why the No?

  6. 6.Switch poisoning floods a switch with frames carrying many bogus source addresses. Why does that let an attacker sniff traffic?

  7. 7.A network of a few hundred hosts is being designed. Switches or routers?

What to remember

  • Three cases on the destination lookup: no entry → broadcast, entry on the same interface → filter, entry elsewhere → forward.
  • Learn from the source, decide from the destination. A frame is evidence about its sender only, and entries age out if nothing refreshes them.
  • Table 6.1 in one line: hubs isolate nothing, switches isolate traffic but give you only a spanning tree, routers do both and configure nothing by themselves.