A switch fills its own forwarding table by reading the source address of every frame that passes through it, and needs no administrator to do so.
Words you will meet
-
Switch table switch table Simple Which MAC addresses lie behind which switch port. Precise A table in a link-layer switch mapping a MAC address to the interface leading to it, with the time the entry was made. It is built by self-learning and entries are aged out, so the table need not contain an entry for every node in the LAN. introduced in ch. 6 — open in glossary — an address, the interface leading to it, and the time it was learned.
-
Self-learning self-learning Simple The switch works out its own table by watching frames arrive. Precise A switch's table is built automatically and without intervention: when a frame arrives on an interface, the switch records the sending MAC address, that interface and the time. Entries older than the aging time are deleted. A switch is therefore plug-and-play. introduced in ch. 6 — open in glossary — the table is built automatically, dynamically and autonomously.
-
Filtering filtering Simple Deciding a frame does not need to go anywhere, and dropping it. Precise The switch function that determines whether a frame should be forwarded to some interface or simply dropped. A frame is filtered when the switch table says the destination is on the very interface the frame arrived from — the destination has already heard it. introduced in ch. 6 — open in glossary — dropping a frame because the destination is where it came from.
-
Aging time aging time Simple How long an unused switch-table entry survives. Precise The period after which a switch deletes an address from its table if no frame has arrived carrying that address as its SOURCE. The book's example uses 60 minutes. It is what lets a switch cope with a PC being replaced by another with a different adapter, without anyone reconfiguring anything. introduced in ch. 6 — open in glossary — how long an entry survives without a frame to refresh it.
-
Plug-and-play plug-and-play Simple Works when you plug it in, with nothing to configure. Precise A device requiring no configuration by an administrator or user. A switch is plug-and-play because its table builds itself; a router is not, because it and the hosts attached to it need their IP addresses configured. introduced in ch. 6 — open in glossary — nothing to configure, ever.
-
Hub hub Simple A physical-layer repeater: whatever comes in on one interface goes out on all the others. Precise A physical-layer device that regenerates an incoming signal onto every other interface. It has no table, no addresses and no idea what a frame is, so it isolates no traffic and every host shares one collision domain. Unlike a switch, a hub cannot stop two frames from colliding. introduced in ch. 6 — open in glossary — a physical-layer repeater, with no table and no idea what a frame is.
Why this matters
Section 6.4.1 assumed something and admitted it: “we will assume in this section that the switch broadcasts all frames”. This page removes that assumption.
A switch that broadcast everything would give you a hub with extra steps. What makes a switched LAN (Local Area Network) Local Area Network A network covering one building, campus or home. introduced in ch. 1 worth having is that it usually does not broadcast.
The interesting question is how it knows enough not to, given that nobody ever tells it anything.
Three cases, decided from the destination
A frame arrives at the switch on interface x, addressed to DD-DD-DD-DD-DD-DD. The switch looks that address up in its table, and there are exactly three possibilities.
The switch has never seen a frame FROM this address, so it has no idea where the destination is. It forwards a copy to every interface except x. In other words, it broadcasts — and that is what a switch does when it does not know.
Read all steps as text
- No entry in the table — The switch has never seen a frame FROM this address, so it has no idea where the destination is. It forwards a copy to every interface except x. In other words, it broadcasts — and that is what a switch does when it does not know.
- An entry, pointing at interface x itself — The destination is on the very segment the frame came from, so it has already been heard there. Forwarding it anywhere would be waste. The switch discards it — this is the filtering function.
- An entry, pointing at some other interface y — The switch puts the frame in the output buffer for interface y, and nowhere else. This is the forwarding function, and it is why a switched LAN wastes so little: as long as the table is complete and accurate, nothing is ever broadcast.
The book walks two of these through its own Figure 6.22.
| Address | Interface | Time |
|---|---|---|
Cells marked ⓘ have an explanation — click to read it.
Three columns, and every one of them is filled in by the switch itself.
A frame for 62-FE-F7-11-89-A3 arriving on interface 1 is filtered: the table says the destination is out that way, so it has already been heard. The same frame for the same destination arriving on interface 2 is forwarded, to interface 1 only.
Same address, same table, opposite outcomes. The interface it arrived on decides.
In plain words
As long as the table is complete and accurate, the switch sends frames towards their destinations without any broadcasting at all.
That is the whole difference from a hub, and the book puts it plainly: a switch is “smarter” than a hub.
But nobody configures that table
So where does it come from? Is there a link-layer equivalent of the routing protocols in chapter 5? Must an overworked administrator type it in?
Neither. The table is built automatically, dynamically and autonomously, and the procedure has three steps.
- The switch table starts empty.
- For every incoming frame, the switch stores the source address, the interface it arrived on, and the current time.
- An address is deleted if no frame arrives with that address as its source for the aging time.
In plain words
Read steps 2 and 3 again and notice which address they name.
A switch learns from the source address and decides from the destination address. Both happen to the same frame, in that order, and they are never the same lookup.
It makes sense once you say it aloud: a frame arriving from somewhere is evidence about where its sender is. It is no evidence at all about where the receiver is.
Switch table — 0 entries
| Address | Interface | Time |
|---|---|---|
| empty — a switch starts knowing nothing | ||
An entry is deleted when no frame has arrived with that address as its source for 60 minutes.
Frames sent
Send one frame, then send one back the other way. The second is the interesting one.
Send a frame from one host to another, then send one back the other way. The second frame is where the idea lands: it is forwarded on one interface only, because the first frame taught the switch where the sender was.
The clock advances one minute per frame so the times stay readable. Aging is applied on every frame, but you would need to send 60 frames to see an entry expire — the book’s own 60-minute example is in the walk-through below instead.
Send one frame and then send one back the other way. The first must be broadcast, because the destination is unknown. The second is forwarded on a single interface — the reply is cheap because the question paid for it.
The book’s own worked example
At 9:39 a frame with source address 01-12-23-34-45-56 arrives from interface 2, and that address is not yet in the table. So the switch adds a row: the address, interface 2, and the time. That is Figure 6.23.
Now the aging. The entry for 62-FE-F7-11-89-A3 was placed at 9:32. Suppose the aging time is 60 minutes and no frame with that source address arrives between 9:32 and 10:32.
At 10:32 the switch removes the address from its table.
Everyday picture
A receptionist who never gets a staff list. Every time somebody walks out of a corridor, the receptionist notes which corridor they came from. Ask for that person later and the receptionist knows where to point.
Nobody wrote the list. It was assembled from watching, and the entries fade if a person is not seen for an hour.
Where the picture stops. A receptionist would remember a name they merely overheard. A switch will not: it records only who walked out, never who was asked for. That is the source-versus-destination asymmetry, and the widget above marks each new row so you can watch it hold.
Switches are also full-duplex — any interface can send and receive at the same time.
What switching buys, and what it costs
Three advantages, from the book.
Collisions are eliminated. In a LAN built from switches and without hubs, no bandwidth is wasted on collisions at all. The switch buffers frames and never transmits more than one on a segment at a time. Maximum aggregate throughput is the sum of every interface rate.
Links can be heterogeneous. A switch isolates one link from another, so different links can run at different speeds over different media. One switch might carry three 1 Gbps copper links, two 100 Mbps fibre links and one 100 Mbps copper link. It is ideal for mixing old equipment with new.
Management gets easier. A jabbering adapter that transmits endlessly can be detected and internally disconnected, so nobody has to drive back to work at night. A cut cable disconnects only the host on it. In the days of coaxial cable a single break brought down the whole network, and a manager spent hours crawling the floor to find it.
| Hubphysical layer | Switchlink layer | Routernetwork layer | |
|---|---|---|---|
| Traffic isolationTable 6.1 | |||
| Plug and playTable 6.1 | |||
| Optimal routingTable 6.1 | |||
| How far up does it read? |
Cells marked ⓘ have a reason behind them — click to read it.
The book’s own three-row comparison, with a fourth row added for the layer each device works at. Click any cell.
The costs are real too. A switched network’s active topology is restricted to a spanning tree, so redundant links exist but cannot be used. A large switched network needs large ARP (Address Resolution Protocol) Address Resolution Protocol Translates an IP address into the MAC address of an interface on the same subnet. It works only within one subnet, which is the whole point. introduced in ch. 6 tables and generates substantial ARP traffic. And a switch is vulnerable to a broadcast storm broadcast storm Simple One broken host floods the whole network with broadcasts. Precise A failure in which a host transmits an endless stream of broadcast frames, which every switch dutifully forwards everywhere, collapsing the entire network. Switches are susceptible to it; routers provide firewall protection against it, because they do not forward layer-2 broadcasts. introduced in ch. 6 — open in glossary : one host transmitting an endless stream of broadcast frames will have every switch faithfully forward them until the network collapses.
A router is immune to that last one, because it does not forward layer-2 broadcasts at all.
Switch poisoning
Because a switch broadcasts frames whose destination is not in its table, an attacker does not need to break the switch to listen. They need only make it forget.
Switch poisoning floods the switch with packets carrying many different bogus source addresses. The table fills with rubbish and has no room left for the legitimate hosts — so the switch falls back to broadcasting, and a sniffer hears everything.
Note which field the attack exploits: the source address, the one the switch trusts without checking. Nothing verifies that a frame’s source address belongs to the host that sent it.
So when do you use which?
Small networks of a few hundred hosts have a few LAN segments, and switches are enough: they localise traffic and raise aggregate throughput with no IP (Internet Protocol) Internet Protocol The network-layer protocol that defines the datagram format and addressing every Internet device must use. introduced in ch. 1 configuration at all.
Larger networks of thousands of hosts put routers inside the network, along with switches. Routers isolate traffic more robustly, contain broadcast storms, and choose more intelligent paths.
Check yourself
Check yourself
0 of 7 answered1.Which address does a switch put into its table, and which does it look up?
2.predictA frame for 62-FE-F7-11-89-A3 arrives on interface 1. The table says that address is on interface 1. What does the switch do?
3.predictA switch has just been plugged in, so its table is empty. Host A sends a frame to host B, then B replies to A. How is each frame handled?
4.predictAn entry was placed at 9:32 and the aging time is 60 minutes. No frame carries that source address afterwards. When is it removed?
5.Table 6.1 gives switches Yes for traffic isolation and plug-and-play, but No for optimal routing. Why the No?
6.Switch poisoning floods a switch with frames carrying many bogus source addresses. Why does that let an attacker sniff traffic?
7.A network of a few hundred hosts is being designed. Switches or routers?
What to remember
- Three cases on the destination lookup: no entry → broadcast, entry on the same interface → filter, entry elsewhere → forward.
- Learn from the source, decide from the destination. A frame is evidence about its sender only, and entries age out if nothing refreshes them.
- Table 6.1 in one line: hubs isolate nothing, switches isolate traffic but give you only a spanning tree, routers do both and configure nothing by themselves.