Ethernet, MAC addresses and switching¶

Exercise ethernet-mac-and-switching-annex.pdf · PDF

In How a message travels, the switch read the outer envelope and handed it to the right door. Nobody ever told it where each computer is plugged in. So how does it know? And when you typed ping 10.G.0.12, you only gave an IP address. The frame needs a MAC address. Where did your PC get it?

Every wired network you will ever touch, at home, in an office or in a data centre, works with the three tables on this page. When "the PC next to me does not answer", these tables are the first place a technician looks.

The Ethernet frame¶

An Ethernet frame is the outer envelope of the link layer: a header with two MAC addresses, the packet inside, and a checksum at the end.

Field by field:

So a frame is between 64 and 1518 bytes. The ping of the last page was length 98: 14 bytes of header plus 84 bytes of packet (tcpdump does not show the FCS).

The MAC address, again¶

From Unit 1: a MAC address is 48 bits = 6 bytes = 12 hex digits, set in the network card at the factory. Now look closer.

• The first 3 bytes are the OUI (Organizationally Unique Identifier): the manufacturer's code, sold by the IEEE.
• The last 3 bytes are the maker's own serial number for that card.
• 2⁴⁸ is about 281 trillion addresses.

Two special cases:

• ff:ff:ff:ff:ff:ff is the broadcast address: "to everybody on this network". In the postal analogy, a leaflet for every letterbox in the building.
• If the second hex digit is 2, 6, a or e, the address is locally administered: not from a factory, but made up by software. Virtual machines and containers do it. So do phones, which invent a different MAC for each Wi-Fi network, for privacy.

Lab: your own network card¶

On the Ubuntu host (the real PC, not the lab), list your network cards:

ip -br link

You see lo (the loopback, the PC talking to itself) and the real card, with a name like enp3s0 or eno1, followed by its MAC. Type the first three bytes into the Wireshark OUI lookup page (https://www.wireshark.org/tools/oui-lookup.html): it tells you the maker, for example Intel or Realtek. Compare with a neighbour: PCs of the same model share the first half.

Now inside the lab. Start the lan lab from the last page and look at pc1's card:

G=3 containerlab deploy -t lan.clab.yml
docker exec -it clab-lan-pc1 bash
ip link show eth1

root@pc1:/# ip link show eth1
4: eth1@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 46:62:c0:ea:cd:fc brd ff:ff:ff:ff:ff:ff link-netnsid 1

The second digit in the sample is 6: locally administered. The OUI lookup finds no maker. Every container in the lab gets one of these.

How a switch learns¶

A switch keeps a MAC address table: a list of which MAC address lives behind which port.

Nobody types that table. The switch builds it alone, with three rules:

1. Learn: when a frame arrives, write its source MAC next to the port it came in on.
2. Forward: if the destination MAC is in the table, send the frame out of that port only.
3. Flood: if the destination is not in the table, or it is the broadcast address, send it out of every port except the one it came in on.

The concierge of Unit 1 never asks anybody's name. It reads the sender on every letter that passes, and remembers which door it came from.

flowchart LR
    IN["<b>Frame arrives</b><br>on port N"] --> LEARN["<b>Learn</b><br>write source MAC → port N"]
    LEARN --> Q{"Destination MAC<br>in the table?"}
    Q -->|"yes"| FWD["<b>Forward</b><br>out of that port only"]
    Q -->|"no, or broadcast"| FLOOD["<b>Flood</b><br>out of every port<br>except N"]

Two more facts:

• Entries are forgotten after 300 seconds without traffic. That is called ageing. A PC moved to another socket is found again.
• The table lives in RAM. A restarted switch starts empty.

Before switches there was the hub, which only knew rule 3: it repeated every frame to everybody, always. Slower, and every PC could read the others' traffic.

ARP: from an IP address to a MAC address¶

Here is the missing piece. You typed ping 10.G.0.12. Your PC knows the destination IP. But the frame needs a destination MAC. Nobody typed one.

ARP (Address Resolution Protocol, RFC 826, November 1982) asks the network: "which MAC address has this IP address?"

It uses two messages:

The answer is kept in the ARP cache, also called the neighbour table, for a while. So the question is not asked again for every packet. ARP only works inside one network: a broadcast does not cross a router.

So one ping to a new neighbour is four frames: ARP request (flooded by the switch), ARP reply, echo request, echo reply. The switch learns two MACs on the way.

Lab: watch ARP and the switch table¶

You need three terminals: pc1, pc2 and the switch sw (docker exec -it clab-lan-sw bash).

ARP asks and answers¶

ip neigh                                      # on pc1: empty
tcpdump -e -n -c 4 -i eth1 arp or icmp        # on pc2 (it waits for 4 frames)
ping -c 3 10.G.0.12                           # on pc1
ip neigh                                      # on pc1, again

On pc2 (group 1, times and line ends cut to fit):

46:62:c0:ea:cd:fc > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 10.1.0.12 tell 10.1.0.11
1a:0d:d5:0a:2b:81 > 46:62:c0:ea:cd:fc, ethertype ARP (0x0806), length 42: Reply 10.1.0.12 is-at 1a:0d:d5:0a:2b:81
46:62:c0:ea:cd:fc > 1a:0d:d5:0a:2b:81, ethertype IPv4 (0x0800), length 98: 10.1.0.11 > 10.1.0.12: ICMP echo request
1a:0d:d5:0a:2b:81 > 46:62:c0:ea:cd:fc, ethertype IPv4 (0x0800), length 98: 10.1.0.12 > 10.1.0.11: ICMP echo reply

And on pc1:

root@pc1:/# ip neigh
10.1.0.12 dev eth1 lladdr 1a:0d:d5:0a:2b:81 REACHABLE

Line 1 goes to the broadcast MAC; line 2 comes back to pc1 only. lladdr (link-layer address) is the MAC of pc2. After about half a minute REACHABLE becomes STALE: still remembered, to be checked again on next use. If the ARP lines do not appear, the cache was already full: run ip neigh flush dev eth1 on pc1 and repeat.

The switch learns¶

The switch's table is called the fdb (forwarding database). bridge is the Linux tool for a software switch.

bridge fdb flush dev br0                      # on sw: forget everything
bridge fdb show br br0 | grep -v permanent    # on sw: empty
ping -c 1 10.G.0.12                           # on pc1
bridge fdb show br br0 | grep -v permanent    # on sw: who is there now?

46:62:c0:ea:cd:fc dev eth1 master br0
1a:0d:d5:0a:2b:81 dev eth2 master br0

One ping taught the switch two MACs: pc1 on eth1, pc2 on eth2. pc3 is missing because it has not sent anything. Ping it (ping -c 1 10.G.0.13) and a third line appears on eth3. (grep -v permanent hides the switch's own addresses.)

A ping to nobody¶

ping -c 2 -W 1 10.G.0.99                      # on pc1: no machine has this address
ip neigh                                      # on pc1

2 packets transmitted, 0 received, 100% packet loss, time 1045ms
10.1.0.99 dev eth1 INCOMPLETE

Nobody has that address, so nobody answers the ARP request. No MAC, no frame: the ping never left as a ping. INCOMPLETE (a few seconds later FAILED) is the first thing to look at when "the neighbour does not answer".

Clean up when you finish: exit in all terminals, then containerlab destroy -t lan.clab.yml --cleanup.

Key takeaways¶

• An Ethernet frame carries destination MAC, source MAC, EtherType, the packet (up to the MTU, 1500 bytes) and an FCS checksum.
• A MAC address has a manufacturer half (the OUI); ff:ff:ff:ff:ff:ff is broadcast; a second digit of 2, 6, a or e means locally administered.
• A switch learns from the source MAC, forwards by the destination MAC, and floods unknown destinations and broadcasts. Entries age out after 300 s.
• ARP finds the MAC of an IP address on the same network: a broadcast request, a direct reply, stored in the neighbour table.
• ip link, ip neigh and bridge fdb show show your card, your neighbours and the switch's table.

Quick check¶

7. A container's MAC address is 46:62:c0cd:fc and the OUI lookup finds no maker. Why?

• The OUI database is out of date
• The second hex digit is 6, so the address was made up by software
• Containers have no MAC address, only an IP address
• Only the last three bytes identify the maker

A second digit of 2, 6, a or e means locally administered: virtual machines, containers and phones make up such addresses. Factory addresses carry a real OUI in the first three bytes.

Next: the MAC address says who a device is, not where it is. Time to meet the address that does, in IPv4 addressing.