Jared Heinrichs

  • Technology Blog
  • Winnipeg Computer Repair
  • Winnipeg Photographer
  • Cooking With Jared
You are here: Home / Networking / Cisco Certification / How do switches work by tracing packet flow

Nov 15, 2013 By Jared Heinrichs 5 Comments

How do switches work by tracing packet flow

I wish I had something like this when I first started networking. Some background on the test network.

  1. There are six computers
  2. Each computer is named PC1->PC6
  3. Each PC has a MAC address that is reflective of it’s name 0020.1111.1111 for PC1->0020.6666.6666 for PC6
  4. Each PC has a IP address that is reflective of it’s name 192.168.1.1 for PC1 –> 192.168.1.6 for PC6
  5. Each Port a pc is plugged into is reflective of it’s name. Port 1 for PC1 –> Port 6 for PC6
  6. Both switches are connected to each other on Gig1/1

I have set this up so when you are looking at commands later on you can easily see where the packets came from and where they are going.

First task is on PC1 we are going to ping PC4. What will happen?

On PC1 type “ping 192.168.1.4” at the command prompt.

How does switches work by tracing packet flow 01

The computer realizes it has absolutely no idea who 192.168.1.4 is because it doesn’t know it’s MAC address. ICMP is put on hold and the computer sends out an ARP request to try and figure out where 192.168.1.4 is.

PC1 sends the frame to switch1. Because this is the first time switch1 has talked with PC1 switch one looks at MAC source address and learns PC1’s MAC address which is 0020.1111.1111

How does switches work by tracing packet flow 02

Switch1 will broadcast out on all ports except the port the frame came in on. That means PC2, PC3 and Switch2 will all receive the exact same frame. PC2 and PC3 will know right away this packet is not for them.

How does switches work by tracing packet flow 03

Switch2 will broadcast out the packet very similarly like switch1 did. PC5 and PC6 know right away it’s not for them. PC4 looks at the frame and says yes… I am 192.168.1.4. My MAC address is 0020.4444.4444. It does so by sending an ARP reply message back to PC1.

How does switches work by tracing packet flow 04

PC4 sends the reply back to switch2.

How does switches work by tracing packet flow 05

switch2 sends the reply back to switch1. Switch1 looks at the frame header and sees that there is a new MAC address of 0020.4444.4444 in the source. Any time 0020.4444.4444 is needed it will just send the frame directly out Gig1/1.

How does switches work by tracing packet flow 06

switch1 knows what MAC address PC1 has so it sends the package directly to PC1. PC2 and PC3 aren’t bothered like they were when this whole process originally started.

How does switches work by tracing packet flow 07

Something to note… A bunch of stuff has happened. If we go back to the command prompt… It hasn’t changed a bit…

How does switches work by tracing packet flow 08

Crazy right?!?!

Now that PC1 knows what MAC address PC4 has it can now do what it wanted to do… ie. ping PC4 using ICMP. PC1 will send an ICMP packet (ping request) to switch1 with a destination address of 192.168.1.4

How does switches work by tracing packet flow 09

switch1 knows that 0020.4444.4444 is somewhere out Gig1/1 so it directly sends the frame to switch2.

How does switches work by tracing packet flow 10

Because switch2 already knows the MAC address of PC4 0020.4444.4444 in its switching table it can forward the ICMP packet to PC4.

How does switches work by tracing packet flow 11

PC4 will now send a reply back to PC1. To do this it will send the packet directly to switch2

How does switches work by tracing packet flow 11

Switch2 will send the packet directly to switch1

How does switches work by tracing packet flow 12

Switch1 will look at the header and realize it needs to go to PC1 and will forward the packet onto PC1.

How does switches work by tracing packet flow 13

It’s at this point the command prompt will change a bit. It will now look like this:

How does switches work by tracing packet flow 14

In the emulator it says ALL requests took a total of 0.012sec.

For  the next 3 ping requests we don’t have to worry about ARP at all. All devices know how to get to each other. As long as the network is stable you would expect the next 3 results to be similar. Notice how the first ping took a little longer and the next 3 are a bit shorter ie6ms? Because ARP isn’t needed for the second, third and forth ping the requests are only 6ms.

How does switches work by tracing packet flow 15

Now that you know how about how a switch works let’s ask some more questions…

1.) What would happen if PC2 were to ping PC5? Would ARP be needed? If so what devices would get the ARP request.

2.) What would happen after PC2 pinged PC5 and PC1 would ping PC5? Would ARP be needed? If so what devices would get the ARP request?

3.) What would happen after PC1 pinged PC5 and PC1 pinged PC6? Would ARP be needed? If so what devices would get the ARP request?

4.) Would would happen after PC1 pinged PC6 and PC1 pinged PC3? Would ARP be needed? If so what devices would get the ARP request?

Answers to these questions can be found here: http://jaredheinrichs.com/answers-to-how-do-switches-work-by-tracing-packet-flow-post.html

Filed Under: Cisco Certification

Comments

  1. Neil John Ramos says

    Nov 15, 2013 at 1:14 pm

    Should it be all the PC’s will register their mac addresses on the switch cam table when the PC1 sends the ARP request for the first time? Please reply

  2. Jared Heinrichs says

    Nov 15, 2013 at 1:26 pm

    I don’t want to give too much away on the question post. I’ve now inserted the link to the answers to the questions and I think it will answer your question. I’ve put the link at the end of the post. Hope that helps.

  3. Ratapelua says

    Oct 19, 2014 at 3:43 am

    Really nice Jared!
    Is there any possiblity that you have another explanation similar with a router in between?

    Thank you in advance,
    Regards,
    Atai

  4. Ratapelua says

    Oct 19, 2014 at 3:47 am

    Sorry I just realized that you have another post with a router!
    Really appreciated that you shared your knowledge!!!

    🙂

  5. Ratapelua says

    Oct 21, 2014 at 12:02 pm

    Hey Jared,

    I am quite fan of you.
    Do you have by any chance any post with three switches using different VLANS?

    Thank you in advance,
    Regards,
    Atai

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Categories

  • Board Game Rules
  • Camera
  • Computer Hardware
    • Blackberry
    • drivers
    • iPad
    • Magic Jack
    • USB
  • Damn Small Linux
  • Exam Notes
  • Facebook
  • FREE Flashcards
  • Games
    • PC
      • League of Legends
    • Wii
    • xbox 360
  • Music
  • Networking
    • Cisco Certification
    • Mitel
    • Palo Alto Firewall
  • News
    • Google
    • Microsoft
  • Operating System
    • Active Directory (2003)
    • Android
    • Command Prompt
    • Damn Small Linux
    • Group Policy
    • Hyper-V
    • IIS
    • ISA 2006
    • Mac OS X
    • Microsoft Exchange Server
    • Powershell
    • Security
    • SME Server
    • Terminal Server 2003
    • Ubuntu Linux
      • Adito Web SSL VPN
      • OpenVpn-als
      • Webmin
    • Virtual Machine Manager
    • Windows 2003 SBS
    • Windows 2003 Server
    • Windows 2008
    • Windows 2008 R2
    • Windows 2012R2
    • Windows 7
    • Windows 8
    • Windows Command Line
    • Windows Deployment Services
    • Windows Server Backup
    • Windows Vista
    • Windows XP
  • Phones
  • Photography
  • Photos
    • Animals
    • Misc
    • Nature
    • Portraits
  • Portfolio
  • Programming
    • CSS
    • HTML
    • jQuery
    • MySQL
    • PHP
    • Script
  • Programs
    • Acrobat
    • Acrobat Reader
    • Adobe Dreamweaver
    • Adobe Illustrator
    • Adobe Photoshop
    • Anti-virus Software
    • Antivirus
    • Backup Exec
    • Bittorent
    • Blackberry BESADMIN
    • Internet Explorer 9
    • Lightroom
    • Microsoft Office
    • Netbeans
    • Onenote
    • Outlook
    • Shelby
    • Sysprep
    • Trend
    • Video Editing
    • Visual Studio
    • Windows Live Writer
    • WireShark
    • XP Mode
    • Zarafa
  • Recipe
  • Review
  • Software Links
  • Troubleshooting
  • Uncategorized
  • Videos
  • Web Applications
    • Brage
    • Google
    • Spiceworks
    • Wordpress
  • Web Browsers
    • Internet Explorer
  • Web Server
    • XAMPP
  • Winnipeg
    • ISP

Try searching this site!

Copyright © 2021 Winnipeg Web Design