How Layer 2 switches learn, forward, and avoid loops — and how VLANs carve one physical LAN into multiple logical broadcast domains.
| Fact | Detail |
|---|---|
| Hardware | Hardware-based; uses ASICs (Application Specific Integrated Circuits) to make filtering decisions |
| OSI Layer | Moves frames at the Data-Link Layer (Layer 2) by reading the MAC address off the host's NIC. Switching is always a Layer 2 function; a Layer 3 switch adds routing, but that routing function is always Layer 3 |
| Role | A general connectivity/aggregation point that connects LAN components (computers, printers, other switches); used for workgroup connectivity & network segmentation |
| Identification | Each device is identified by a 48-bit unique MAC address, which the switch uses to regulate traffic flow — maximizing security, minimizing needed bandwidth, and improving efficiency |
| Switch vs. Hub | A hub floods every port with every message (shared bandwidth, no security/ID). A switch is smarter — each switch port is its own collision domain |
| Trait | Meaning |
|---|---|
| Hardware-based bridging | ASICs let the switch learn and form multiple internal connections to pass or filter traffic |
| Wire speed | Can be configured to match the media/cable speed (e.g., 100 Mbps Ethernet → set to 100 Mbps) |
| Low latency | Receives, processes, and applies an update in minimum time so traffic flow resumes quickly |
| Low cost | "Low-cost, high port density" — inexpensive relative to the number of ports available |
| Broadcast control | Can segment a network into smaller broadcast domains when paired with VLANs. Without VLANs, broadcasts aren't filtered until they reach a Layer 3 device |
| Component | Detail |
|---|---|
| Console Port | Direct local access via a console/rollover cable and terminal emulation software (HyperTerminal, PuTTY) for initial configuration of a "blank" switch. Every networking device has one. DoD policy requires it be password protected because local access only requires physical presence |
| Network Interfaces (switch ports) | Where end devices like computers/printers connect. Count varies and can grow via plug-in modules. Usable to test connectivity (ping). Once an IP is assigned, interfaces can accept a Telnet connection for remote management — the IP is only for logging in; forward/filter decisions still use MAC addresses |
| Memory | Holds |
|---|---|
| Flash Memory | The operating system (OS); loaded into RAM every time the switch boots |
| ROM (Read Only Memory) | Diagnostic and boot-up routines; burned-in and cannot be accessed or changed |
| RAM (Random Access Memory) | The switch's running memory for all operations; configuration changes live here in the running-configuration file |
| NVRAM (Non-Volatile RAM) | Long-term storage for the startup-configuration file, which loads into RAM at boot and becomes the running-configuration |
| Protocol / Standard | Description |
|---|---|
| PPP (Point-to-Point Protocol) | Data-link layer protocol connecting two devices directly, without relying on a host/networking system. Provides encryption, compression, and authentication; encapsulates a network-layer packet inside the PPP frame |
| STP (Spanning Tree Protocol) — IEEE 802.1D | Loop-prevention protocol; switches communicate to discover physical loops and build a loop-free logical topology |
| IEEE 802.1D | The Ethernet MAC bridges standard, which includes bridging, STP, and others; standardized by the IEEE 802.1 working group |
| UDLD & Loopguard | Handle unidirectional links (traffic fails in only one direction, e.g., bad transmitter/receiver/cable). UDLD shuts down the port that stops hearing its partner; Loopguard instead puts the port into a "loop inconsistent" state |
| LLDP (Link Layer Discovery Protocol) | Open, vendor-neutral IEEE-standard Layer 2 protocol for network management/monitoring. Devices advertise MAC address, VLAN, IP management address, system name, port details, MDI power, and link aggregation to connected neighbors. Runs on Cisco and non-Cisco devices |
| CDP (Cisco Discovery Protocol) | Cisco-proprietary protocol that supports the IEEE 802.1ab version of LLDP; shares information between directly connected Cisco devices |
| IEEE 802.1Q vs. ISL | 802.1Q encapsulates a VLAN frame using space in the standard frame header (open, works with all major manufacturers). ISL instead adds a new header and trailer to the existing frame (Cisco devices only) |
| Function | What Happens |
|---|---|
| Address Learning | The switch reads a frame's source MAC address and stores it — with its interface ID — in the MAC address table (a.k.a. CAM / Content Addressable Memory), stored in RAM. The table starts empty |
| Forward/Filter Decision | The destination MAC is compared to the MAC address table. If it's listed, the frame is forwarded only out that interface (filtering). If it's not listed, the frame is flooded out all active ports except the one it arrived on |
| Loop Avoidance | Prevents multiple paths between devices from crippling the network with broadcast storms, multiple frame copies, or multiple loops |
| Loop | Simply more than one path to a destination device. Multiple links/switches are used on purpose to avoid a single point of failure — but the resulting loops can cripple the network if left unmanaged |
| Problem | Description |
|---|---|
| Broadcast Storms | Also called a network storm; the network is overwhelmed as nodes send broadcast traffic and other devices keep rebroadcasting it back, eventually failing network communication. Caused by poor technology, low port-rate switches, and improper configuration |
| Multiple Frame Copies | A device receives the same frame more than once because it arrives from different LAN segments simultaneously. This "thrashes" the MAC address table as it constantly updates source-hardware-address locations |
| Multiple Loops | Loops occurring within other loops. If a broadcast storm also occurs, all usable bandwidth is consumed and the network can no longer perform packet switching |
| Standard | Detail |
|---|---|
| STP (IEEE 802.1D) | Prevents bridging loops in data networks and provides loop-free topologies |
| RSTP (IEEE 802.1w) | Rapid Spanning Tree Protocol, introduced by IEEE in 2001 |
| Method | How It Works |
|---|---|
| Store-and-Forward | Stores the entire frame in memory and checks it with a CRC (cyclical redundancy check) before forwarding. Bad frames are discarded and an error message is sent to the sender's MAC address. Ensures a high level of error-free traffic |
| Cut-Through | Copies only the destination MAC address into memory, looks it up, and places the frame on the outgoing interface immediately. Lowest latency, but bad frames are forwarded and the destination must request a resend |
| Fragment-Free | A hybrid: stores the first 64 bytes before forwarding, since that's where fragmentation is most likely to occur. If fragmentation is found, the frame is discarded and an error message is sent to the sender |
| Term | Detail |
|---|---|
| Collision | Two systems transmit at the same time on shared bandwidth — a normal part of Ethernet, not an error condition by itself |
| Late Collision | A collision that happens after a host has already transmitted the first 64 bytes of its frame — after other hosts should have noticed it was transmitting. Often caused by an oversized/unsegmented LAN, faulty devices, or a duplex mismatch (e.g., half-duplex/full-duplex) between connected devices |
| VLAN Definition | A "logical" grouping of network devices into a single broadcast domain, independent of physical location |
| Flat Network | A network with a single broadcast domain, where every connected device sees every broadcast packet transmitted |
| Purpose | Switches provide limited Layer 3-style broadcast control by using VLANs to segment the network into smaller broadcast domains, keeping problems on one segment from propagating through the internetwork |
| Inter-VLAN Traffic | VLANs keep broadcasts from one VLAN out of another. As a result, communication between VLANs must go through a Layer 3 routing process |
| Benefit | Detail |
|---|---|
| Increased Security | Only devices in the same VLAN receive its frames. The administrator controls each port and what resources it can reach; traffic from one VLAN is not accessible from another |
| Flexibility & Scalability | Devices can be added to or limited from a broadcast domain regardless of physical location |
| No Geographical Barrier | Workgroups are no longer confined to physical locations — a VLAN can span multiple physical LAN segments while staying one logical broadcast domain |
| Default | Cisco switches come with default VLAN 1 already created; all ports start assigned to VLAN 1 until an administrator changes them |
| Numbering & Naming | VLANs are identified by number (VLAN 1, VLAN 10, VLAN 20…) referenced consistently across systems, and should also get a descriptive name — "Sales" is better than the default "VLAN0010" |
| Cross-Switch Consistency | If VLAN 30 is created on one switch and VLAN 30 on a connected switch, both treat all VLAN 30 traffic as a single local network |
| Scope | VLANs can exist on a single switch or span multiple switches, such as Access Switches (ASWs) and Distribution Switches (DSWs) |
| Port Membership | A port can only be a member of one VLAN at a time. View assignments on Cisco switches with show vlan in privileged EXEC mode |
| Unused Ports | Any port not in use should be shut down and assigned to an inactive VLAN to reduce vulnerabilities and improve security |
| VLAN | Name | Status | Ports |
|---|---|---|---|
| 1 | default | active | Fa0/4–Fa0/11 |
| 10 | Sales | active | Fa0/12–Fa0/15 |
| 20 | Marketing | active | Fa0/16–Fa0/19 |
| 30 | Research | active | Fa0/20–Fa0/23 |
| Port Type | Detail |
|---|---|
| Trunk Port (tagged port) | A connection between network devices that can carry more than one VLAN. Frame tagging assigns a user-defined trunking ID to each frame, matching it to its VLAN as it crosses the switch fabric |
| Access Port (untagged port) | A member of only one VLAN. When a frame is placed on an access port, its VLAN tag is removed |
| Method | Notable Facts |
|---|---|
| ISL (Inter-Switch Link) | Cisco-proprietary trunking standard (deprecated); adds a new header and trailer to the existing frame; Cisco devices only |
| IEEE 802.1Q | Open, defined standard for trunks; encapsulates the VLAN tag using space in the standard frame header; works with all major manufacturers' equipment |
| Purpose | Used for Telnet (logging onto a device), SNMP (Simple Network Management Protocol — manage/monitor devices), and syslog (devices sending messages to a logging server) |
| Default Behavior | Switches use VLAN 1 as the default VLAN for in-band management and to communicate with other devices using STP, CDP, DTP (Dynamic Trunking Protocol), VTP (VLAN Trunking Protocol), and PAgP (Port Aggregation Protocol) — all as untagged traffic |
| The Risk | If not appropriately pruned, VLAN 1 may unwisely span the entire network. The larger its scope, the greater the risk of compromise |
| Best Practice | Do not make VLAN 1 the management VLAN. Prune unnecessary ports from both VLAN 1 and the management VLAN, and separate in-band management, device protocol, and data traffic |