Monday, November 08, 2004

switch floods packets with unknown destination MAC addresses to all ports

By default, a switch floods packets with unknown destination MAC addresses to all ports. If unknown unicast and multicast traffic is forwarded to a switch port, there might be security issues. To prevent forwarding such traffic, you can configure a port to block unknown unicast or multicast packets

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/12_1_20/config/uniflood.pdf

L2 switching

Like a bridge, a switch also has a bridging/forwarding (or MAC address) table. In this case, each port has only a single computer connected. As such, each collision domain is made up of only one system – without multiple systems in a collision domain, collisions cannot occur. This is part of the reason why companies have migrated to switches from hubs – the lack of collisions allows full access to bandwidth, as well as the ability for connected systems to communicate in full-duplex. However, it is also possible to plug a hub into a switch. Consider the example below, where a hub is plugged into port 3 on the switch. The 4 computers plugged into the hub can only communicate in half duplex, and are all part of the same collision domain. Once the bridging table on the switch has been updated, the MAC addresses of all 4 computers will be shown as being accessible via port 3. If you've ever wondered why the MAC address tables in many switches are rated to support up to 1000 or more MAC addresses, this is the reason – it is possible that many levels of hubs ultimately terminate on the same switch port.

The operation of the switch is almost identical to that of a bridge. The MAC address table of a switch is built by inspecting the source MAC address of frames. Forwarding decisions are made using the destination address of frames. When the switch receives a frame, it looks at the destination MAC address and then forwards it out only the port associated with that MAC address. Like a bridge, a switch will always forward all broadcast and frames with unknown destinations to every port, with the exception of the port on which the transmission originated.

It is exceptionally important to recognize the impact of a switch in the network communication process. When only a single system is connected to each and every switch port, not only is each collision domain made up of only one system, but full-duplex communication also becomes possible. In other words, if three systems were connected at 10 Mbps, and a server was connected at 100 Mbps, all three clients could both send and receive a full 10 Mbps of traffic to the server simultaneously. This is a huge step up from a hub, where the basic bandwidth (say 10 Mbps) would be shared amongst all four system, half-duplex, with collisions probably a very regular occurrence. Because of this, many people consider a switch to be a magic box, and in a way it is – I can't think of a single way to squeeze dramatically better performance out of a network than by replacing all hubs with switches.

http://www.networknewz.com/2004/0505.html