Watch first

Also watch — playlist supplement

Plain-English explanation

Ethernet delivers frames using 48-bit MAC addresses (burned-in or configured). Switches maintain a MAC address table (CAM table): source MAC on incoming frames is recorded against the incoming port. Unknown unicast destinations are flooded out all ports except the source until the switch learns where the host lives.

ARP (Address Resolution Protocol) maps a known IPv4 address to a MAC address on the local subnet. ARP requests are broadcast ("who has 192.168.1.1?"); replies are unicast back to the requester.

Routers do not forward ARP across subnets — if the destination is remote, ARP targets the default gateway, not the remote IP.

Deep dive

Unicast vs broadcast vs multicast frames:

• Unicast — one destination MAC
• Broadcast — FF:FF:FF:FF:FF:FF, all hosts on VLAN process it
• Multicast — group address; modern switches can snoop IGMP for efficiency

Collision domains: Switches microsegment — each port is typically its own collision domain (full duplex). Hubs shared collisions (legacy).

Broadcast domains: One VLAN = one broadcast domain. Routers (and L3 boundaries) separate broadcast domains.

Gratuitous ARP: Host announces "I am IP X, MAC Y" — used after IP change or by some FHRP protocols. Know it exists for exams.

Step-by-step — first ping on a LAN

PC 192.168.1.10 pings 192.168.1.20 (same /24):

1. PC checks subnet — local delivery
2. ARP cache empty for .20 → ARP request broadcast: "Who has 192.168.1.20?"
3. .20 replies unicast with its MAC
4. PC builds ICMP echo inside IP inside Ethernet frame to .20's MAC
5. Switch learns PC's MAC on Fa0/1, .20's MAC on Fa0/2, forwards unicast

If target were remote, step 2 would ARP for the gateway MAC instead.

Commands to know

show mac address-table
show mac address-table dynamic
show ip arp
clear mac address-table dynamic

Windows
arp -a
Linux
ip neigh show

Troubleshooting

| Problem | Likely cause | Fix direction | |---------|--------------|---------------| | IP configured, no L2 delivery | ARP failure, wrong VLAN | Verify VLAN/port, show ip arp | | Intermittent connectivity | MAC flapping, loop | STP, check duplicate MAC/IP | | Switch CPU high | Broadcast storm | Find loop, BPDU guard, storm control | | Wrong host receives traffic | Stale MAC entry | Clear dynamic MAC, check topology |

"Works for a minute then stops" often means a loop or duplicate IP causing ARP/MAC instability.

Exam relevance

Practice checklist

• Explain how a switch populates its MAC table from a single frame
• Draw ARP request/reply including broadcast vs unicast
• State why ARP is limited to one broadcast domain
• Predict flood vs forward for unknown and known unicast MACs
• Use packet walk tool to narrate ARP before the first ping