Difference between broadcast and unknow unicast flooding

[cosimodagostino]

Hi everyone I have read the differences between unknown unicast flooding and broadcast on this forum. Broadcast ok is clear but Unknown unicast flooding there's a bit of confusion. How does the host already know the destination mac address without making an arp request? At this point I think that the sending host had the destination mac address in its arp cache and that for example an attack on the mac address table, the destination host's mac is overwritten by fake mac addresses. The only ways the host has to know the destination mac address are: 1) Arp request 2) mac table of the switch 3) host arp cache At this point in case of Unknown unicast flooding I think that the sending host knows the mac address of the destination host via arp cache. What do you say?

[Joseph W. Doherty]

Yes, that's correct, but now it's unclear what you're trying to get answered.

Your topic was listed as "Difference between broadcast and unknow unicast flooding" and your OP asks "What do you say?" after describing the usual way switches, and hosts, would learn destination MAC via ARP.

So, what is it your trying to find out or confirm?

My, and other posters, have confirmed that yes, if ARP functions as expected, there shouldn't be any unicast flooding.  However, if you don't do the "usual" ARP or the switch's MAC entry flushes before the host's ARP entry, unicast flooding will happen.

Further, as I mentioned, unicast flooding and broadcast flooding are conducted the same way, frame is transmitted on all ports within same L2 domain, except the ingress port.  From your last posting, basically the same information you've also obtained from Wendell's book.