What is the Cisco switch sending data messaging process.

[Cisco10956]

Computer 1 ( TCP / IP ) “ 192.168.10.5 “ on the switch sends a “data” message to Computer 2 ( TCP/ IP ) “ 192.168.10.8” and there is no router. This is a 20 port switch with 10 computers connected and all belong to VLAN2.

It’s my confused understanding that computer 1 sending out a broadcast with the message to all computers with-Out checking the MAC address table and only using IP addresses.

But then I also researched explanations that says computer 1 going to the MAC address table to find computer 2 and then broadcasting the message to computer 2. 

Question : What is the correct process of sending a “ data” message from computer 1 to computer 2.

How does this really work.

[MHM Cisco World]

...

[Cisco10956]

Hi MHM thanks for the answer. - This does put light on this process.

Question:  If there is " already " a MAC address entry for PC-2 in the table. 

                  Is a Broadcast still needed.  if there is already a MAC address in the table for the PC

[MHM Cisco World]

....

[Richard Burts]

One of the points of confusion in the original post is what is sent as a broadcast. The answer is that if a device needs to discover the mac address of another device then it sends an arp request as a broadcast. Once the device has the mac address of the destination then all data messages will be sent as unicast. The data packet will have the correct IP address of the destination and the correct mac address of the destination. No data packet would be sent as a broadcast.

The forwarding logic of the switch is that if it receives a broadcast frame then it forwards the frame to all ports belonging to that vlan. If the switch receives a unicast then it forwards the frame directly to the port of the destination.

It might help to think a bit about where mac addresses are stored. The switch maintains a mac address table which it uses to keep track of which mac address is on which interface. The switch builds this table by observing traffic. Each time the switch receives a frame it looks at the source mac address and checks its mac address table and if necessary builds an entry in the table for the mac address that it just observed. The switch uses this table in forwarding unicast traffic. The hosts connected to the switch also maintain a table of mac addresses, which is the arp table of the device. If PC1 wants to communicate with PC2 it checks its arp table. If it already has an entry for PC2 then it just sends a unicast data frame. If it does not have an entry for PC2 then it sends a broadcast arp request.

[Cisco10956]

Richard Burts, I believe your explanation is a very very good one, although I do have to give some of the credit to MHM.

   I have found there is good information, and just plain bad information on this subject matter, and a major problem is " The bad out numbers the Good ".  

I have one - last question: - Please

Example When I  Ping the ip address or name of pc2 from pc1: Again no router involved : The MAC address of PC2 is already in table.

Please tell me if my understanding is correct from my example.

PC1 will check cache in it's OS to find either the name or ip address of PC2 to make a match of it's MAC address and IP ; then send the ping " unicast " request to find the MAC address in the switches table, then finds the MAC, and then Finds PC2, and a reply comes back from the ping.   Is this all correct. 

[Jon Marshall · Accepted solution]

Assuming the PCs are in the same vlan/IP subnet, as you say there is no router,  PC1 checks it's arp cache and if there is an entry for PC2 it uses the mac address in the arp entry and sends the unicast ping to PC2. 

If there is no entry for PC2 in it's arp cache it will send an arp broadcast which PC2 receives and responds with it's mac address. 

I'm not sure what you mean by sending ping unicast to find entry in switch table but no this does not happen unless I am misunderstanding what you are saying. 

Jon

[MHM Cisco World]

...

[Richard Burts]

The original poster has a follow up question "When I Ping the ip address or name of pc2 from pc1: Again no router involved : The MAC address of PC2 is already in table." There have been several mentions of tables with mac addresses and there are several types of tables with mac addresses. So I would like to be clear about them, what they are, how they are built, and how they are used.

1) There is a table of mac addresses on the switch. This is sometimes referred to as the layer 2 forwarding table. In this table are mac addresses, with the vlan that they belong to, and with the port of the switch on which they are found. The switch uses this table when it receives a frame and needs to forward the frame to a destination within the same vlan. The switch builds this table by examining every frame that it receives. The switch takes the source mac, the vlan ID, and the port ID and looks into its table. If there is already an entry in the table that matches these parameters then the switch proceeds to make its forwarding decision. If there is not an entry for that mac address then the switch creates an entry before it makes its forwarding decision. If there is an entry for that mac but either the vlan ID or the port ID are different the switch updates the content of the table and then makes its forwarding decision.

2) There is a table which has mac addresses and the associated IP address. This is the arp table. Each device connected in the network will have an arp table. When the device needs to send a data packet to some destination it checks its arp table. If there is already an entry in the arp table for the destination IP address the device simply uses the associated mac address as the destination mac in the packet and sends the packet. If there is not an entry in the arp table for the destination IP address then the device holds the packet it wants to send, and sends an arp request for the destination IP. If it receives a response it builds a new entry in its arp table, uses the mac address from the reply and sends the data packet. (If there is no response to the arp request the device will drop the data packet)

Note that PC1 and PC2 each maintain their own arp table. There is also an arp table on the switch. The switch does not its own arp table if it is forwarding from PC1 to PC2 but does use its own arp table if the switch has generated a data packet and needs to send it to some destination (for example if the switch is sending syslog messages to a logging server in the network).

[MHM Cisco World]

...

[Richard Burts]

MHM

Following up on this statement " and then when PC-1 send unicast frame the SW will FLOOD it to all PORT in VLAN X except the port it come from" When PC1 sends the unicast frame what did it insert into the destination mac address? How did it learn the mac of PC3 except for sending an arp request. And if PC3 send an arp response then the switch has seen traffic from PC3 and has created an entry in its layer 2 forwarding table.

[MHM Cisco World]

...

[Richard Burts]

MHM

point taken. If there is a mismatch between arp timer and mac address timer (where arp timer is longer than mac address table timer) then unknown unicast flooding can occur. This is more likely to occur when the sending device is a network device (where arp timer tends to be much longer) but it is possible that a host arp timer could be longer than the switch mac address table timer.