Skip to content

Lab 06 — Ethernet Switching Fundamentals

Item Details
Lab 06
Lab Name Ethernet Switching Fundamentals
Track CompTIA Network+
Difficulty Beginner–Intermediate
Estimated Time 100–130 minutes
Primary Role Network Technician / Junior Network Administrator
Environment Network+ Virtual Switching Lab
Primary Systems NETPLUS-ADMIN, NETPLUS-CLIENT01, NETPLUS-SERVER01, NETPLUS-SW01
Primary Tools Virtual Switch / Managed Switch CLI, Wireshark, ping, ARP tools
Skills Ethernet Switching, MAC Learning, Forwarding, Flooding, Broadcast Domains, Collision Domains, Interface Troubleshooting

Mission Objective: Understand how Ethernet switches learn MAC addresses, make forwarding decisions, handle broadcasts and unknown unicasts, and how interface state, speed, duplex, and topology influence Layer 2 communication.

You are working as a Junior Network Technician at GHC Enterprise.

Your network has expanded from direct virtual connectivity into a switched Ethernet environment.

The topology is now:

NETPLUS-ADMIN
10.10.10.10
|
|
Port 1
|
+----------------+
| NETPLUS-SW01 |
+----------------+
| |
Port 2 Port 3
| |
| |
CLIENT01 SERVER01
10.10.10.20 10.10.10.30

The senior administrator asks you:

“How does the switch know where to send an Ethernet frame?”

Your task is to investigate how the switch:

Receives Frame
Learns Source MAC
Looks Up Destination MAC
Forwards / Floods / Filters
Updates MAC Address Table

You will also troubleshoot common switching issues.

By completing this lab, you will be able to:

  • explain Ethernet switching

  • understand switch ports

  • understand MAC address tables

  • observe dynamic MAC learning

  • identify source MAC learning behavior

  • explain destination MAC lookup

  • distinguish forwarding from flooding

  • understand unknown unicast flooding

  • understand broadcast forwarding

  • understand frame filtering

  • identify collision domains

  • identify broadcast domains

  • understand full duplex and half duplex

  • understand speed negotiation concepts

  • inspect interface state

  • troubleshoot disabled interfaces

  • recognize incorrect speed/duplex symptoms

  • understand MAC table aging

  • clear dynamic MAC entries safely

  • verify switched connectivity

  • document a switched topology

Add a Layer 2 switch:

NETPLUS-SW01

Connect:

NETPLUS-ADMIN
Switch Port 1
NETPLUS-CLIENT01
Switch Port 2
NETPLUS-SERVER01
Switch Port 3

Logical topology:

NETPLUS-SW01
+----------------+
| |
| |
Port 1 Port 2 Port 3
| | |
| | |
ADMIN CLIENT01 SERVER01
.10 .20 .30

Confirm:

NETPLUS-ADMIN
10.10.10.10/24
NETPLUS-CLIENT01
10.10.10.20/24
NETPLUS-SERVER01
10.10.10.30/24

All three systems should remain in:

10.10.10.0/24

On Linux:

Terminal window
ip link

On Windows:

Terminal window
Get-NetAdapter

Confirm the interfaces connected to the switch are:

UP

From ADMIN:

Terminal window
ping -c 3 10.10.10.20

Then:

Terminal window
ping -c 3 10.10.10.30

From CLIENT01:

Terminal window
ping 10.10.10.30

All should succeed.

A Layer 2 switch receives:

Ethernet Frames

and makes forwarding decisions primarily using:

Destination MAC Address

Conceptually:

Frame Arrives
Learn Source MAC
Read Destination MAC
Check MAC Address Table
Forward / Flood / Filter

A switch builds a table resembling:

MAC Address Port
ADMIN MAC Port 1
CLIENT01 MAC Port 2
SERVER01 MAC Port 3

This may also be called:

MAC Table

or:

CAM Table

depending on platform terminology.

When a frame arrives:

Source MAC:
AA:AA:AA:AA:AA:AA
Incoming Port:
Port 1

the switch learns:

AA:AA:AA:AA:AA:AA
Port 1

Important:

Switches learn from the source MAC address, not from the destination MAC address.

On ADMIN:

Terminal window
ip link

On CLIENT01:

Terminal window
getmac

On SERVER01:

Terminal window
ip link

Create:

Host MAC Connected Port
ADMIN <MAC> Port 1
CLIENT01 <MAC> Port 2
SERVER01 <MAC> Port 3

If your switch supports a Cisco-like CLI:

show mac address-table

or equivalent.

Initially, the table may be empty or partially populated.

Record what you see.

Inside the lab, if supported:

clear mac address-table dynamic

or the equivalent command for your platform.

Do not clear production switch tables.

From NETPLUS-ADMIN:

Terminal window
ping -c 2 10.10.10.20

Then inspect the MAC table again.

You should see ADMIN and CLIENT01 learned.

The sequence is approximately:

ADMIN sends frame
Frame enters Port 1
Switch reads source MAC
Learns:
ADMIN MAC → Port 1

When CLIENT01 replies:

CLIENT01 frame enters Port 2
Switch learns:
CLIENT01 MAC → Port 2

Run:

Terminal window
ping -c 2 10.10.10.30

Inspect:

show mac address-table

You should now see:

ADMIN MAC → Port 1
CLIENT01 MAC → Port 2
SERVER01 MAC → Port 3

Suppose ADMIN sends:

Destination MAC:
SERVER01 MAC

The switch checks its table:

SERVER01 MAC
Port 3

Therefore:

Frame received on Port 1
Forward only to Port 3

This is:

Known Unicast Forwarding

Suppose two devices somehow communicate through the same switch port downstream.

If the source and destination are both known on the same outgoing port, the switch may not need to forward the frame to other ports.

This behavior is conceptually:

Filtering

A switch avoids sending frames where they are not required.

Suppose the switch receives:

Destination MAC:
DD:DD:DD:DD:DD:DD

but has no table entry.

The switch does not know which port owns the MAC.

Therefore it may:

Flood the frame

out other ports in the same VLAN.

Conceptually:

Frame enters Port 1
Destination unknown
Flood:
Port 2
Port 3
Port 4
...

except the port where the frame arrived.

The switch needs to ensure that the destination still has a chance to receive the frame.

Once the destination replies:

Reply arrives
Source MAC learned
Future traffic forwarded directly

Clear the switch MAC table.

Then immediately initiate traffic between endpoints.

If your simulator or physical lab allows traffic observation across ports, monitor the initial forwarding behavior.

You should conceptually observe:

Initial Traffic
=
Flooding possible
Later Traffic
=
Known unicast forwarding

Ethernet broadcast destination:

ff:ff:ff:ff:ff:ff

When a switch receives a broadcast:

Broadcast enters Port 1
Switch forwards to all other ports
within the same VLAN

Clear ADMIN’s ARP entry for SERVER01.

Linux:

Terminal window
sudo ip neigh del 10.10.10.30 dev <interface>

Start Wireshark.

Apply:

arp

Then:

Terminal window
ping -c 1 10.10.10.30

Observe the ARP broadcast.

ARP request:

Ethernet Destination:
ff:ff:ff:ff:ff:ff

The switch floods it across the VLAN.

SERVER01 responds:

ARP Reply

The switch learns SERVER01’s MAC from the response source.

The exchange creates two useful effects:

ADMIN sends ARP request
Switch learns ADMIN MAC

then:

SERVER01 sends ARP reply
Switch learns SERVER01 MAC

Therefore ARP and switch learning often occur together.

Capture an ICMP packet after ARP resolution.

Expand:

Ethernet II

Record:

Source MAC:
Destination MAC:

Compare with the switch MAC table.

For ADMIN → SERVER01:

Source MAC:
ADMIN MAC
Destination MAC:
SERVER01 MAC

Switch table:

ADMIN MAC → Port 1
SERVER01 MAC → Port 3

Therefore the expected decision is:

Port 1
Port 3

All devices in the same VLAN belong to the same:

Broadcast Domain

Current topology:

ADMIN
CLIENT01
SERVER01

is one broadcast domain if all are in the same VLAN.

With modern switched Ethernet, each switch port represents a separate collision domain.

Topology:

Port 1
=
Collision Domain 1
Port 2
=
Collision Domain 2
Port 3
=
Collision Domain 3

This is very different from old shared Ethernet hubs.

Conceptually:

Frame In
Repeat Out Every Port
Frame In
Learn Source
Check Destination
Forward Intelligently

With a hub:

Multiple Devices
Shared Collision Domain

With a switch:

Device
Dedicated Switch Port
Separate Collision Domain

A normal Layer 2 switch without VLAN separation does not automatically create a new broadcast domain per port.

Instead:

All Ports in VLAN 1
One Broadcast Domain

VLANs will change this in Lab 07.

Full-duplex communication allows:

Transmit
+
Receive

simultaneously.

Modern switched Ethernet commonly operates:

Full Duplex

Half-duplex allows communication in both directions, but not simultaneously.

Conceptually:

Send
or
Receive

Classic shared Ethernet environments may use half duplex.

Mode Send and Receive Simultaneously?
Half Duplex No
Full Duplex Yes

Ethernet interfaces may automatically negotiate:

Speed
Duplex

Possible speeds include:

100 Mbps
1 Gbps
2.5 Gbps
10 Gbps

depending on interface capabilities.

Run:

Terminal window
ip link

If available:

Terminal window
sudo ethtool <interface>

Review:

Speed:
Duplex:
Link detected:

Run:

Terminal window
Get-NetAdapter

Review:

Name
Status
LinkSpeed

On a managed switch, use a platform-appropriate command.

Cisco-like examples:

show interfaces status

and:

show interfaces

Record:

Port
Status
Speed
Duplex
VLAN
Port Connected Host Status Speed Duplex
1 ADMIN Up <speed> Full
2 CLIENT01 Up <speed> Full
3 SERVER01 Up <speed> Full

A switch interface may be physically connected but manually disabled.

Typical state:

Administratively Down

Meaning:

Configuration
Port Disabled

40. Troubleshooting Scenario — Disabled Switch Port

Section titled “40. Troubleshooting Scenario — Disabled Switch Port”

Disable the SERVER01 switch port using your lab switch/simulator.

For Cisco-like syntax:

interface <port>
shutdown

Then test:

Terminal window
ping 10.10.10.30

Expected:

Failure

Check:

Switch Port Status

Then endpoint:

Terminal window
ip link

or Windows equivalent.

You should determine whether:

Endpoint Interface
or
Switch Port

is causing the problem.

Cisco-like example:

interface <port>
no shutdown

Verify:

Port Up

Then:

Terminal window
ping -c 2 10.10.10.30

Expected:

Success

On physical switches, LEDs may indicate:

Link
Activity
Speed
Errors

They provide useful Layer 1/Layer 2 troubleshooting clues.

44. Troubleshooting Scenario — Cable / Virtual Link Disconnected

Section titled “44. Troubleshooting Scenario — Cable / Virtual Link Disconnected”

Disconnect CLIENT01 from the virtual switch.

Observe:

Switch Port:
Down

and:

Client:
No Layer 2 Connectivity

Reconnect after testing.

Dynamic MAC entries do not normally remain forever.

After a period of inactivity:

Dynamic MAC Entry
Aging Timer
Removed

When traffic resumes:

Switch Learns MAC Again

Devices can:

Move Ports
Disconnect
Reconnect
Change Network Location

Without aging, the table could contain outdated information indefinitely.

Inspect:

show mac address-table

Stop traffic from one endpoint.

Wait for the platform’s configured aging period if reasonable.

Observe whether the entry disappears.

If the default timer is too long for the lab, review the configured aging timer instead of waiting.

48. Understand Dynamic vs Static MAC Entries

Section titled “48. Understand Dynamic vs Static MAC Entries”
Learned Automatically
Configured Manually

Dynamic entries are the normal behavior for ordinary endpoint learning.

49. Troubleshooting Scenario — Host Moves Ports

Section titled “49. Troubleshooting Scenario — Host Moves Ports”

Move NETPLUS-CLIENT01 from:

Port 2

to:

Port 4

Generate traffic.

Inspect the MAC table.

Expected:

CLIENT01 MAC
Port 4

The switch should relearn the new location.

A MAC address appearing on a new port can mean:

Device physically moved
VM moved
Network topology changed
Redundant topology event
Possible Layer 2 issue

Context is required.

51. Troubleshooting Scenario — Duplicate MAC Concept

Section titled “51. Troubleshooting Scenario — Duplicate MAC Concept”

Duplicate MAC addresses are less common than duplicate IP addresses but can create major forwarding confusion.

Conceptually:

MAC-A
Port 2

then suddenly:

MAC-A
Port 3

The switch may repeatedly update the entry.

This is sometimes referred to as:

MAC Flapping

Conceptually:

MAC X learned on Port 1
MAC X learned on Port 2
MAC X learned on Port 1
MAC X learned on Port 2

Possible causes include:

Layer 2 Loop
Misconfiguration
Duplicate MAC
Virtualization Behavior

Do not intentionally create an uncontrolled physical Layer 2 loop in this lab.

Loop behavior and prevention will be investigated safely in:

Lab 08 — Spanning Tree and Layer 2 Redundancy

54. Understand Unknown Unicast vs Broadcast

Section titled “54. Understand Unknown Unicast vs Broadcast”

These are different.

Destination MAC:

ff:ff:ff:ff:ff:ff

Purposefully addressed to all devices in the broadcast domain.

Destination is a specific unicast MAC:

AA:BB:CC:DD:EE:FF

but the switch does not know the port.

The switch may flood it temporarily.

Destination MAC Known
Send to One Correct Port
Destination Unknown or Broadcast
Send to Multiple Ports
within VLAN

A switch can avoid unnecessary forwarding.

Conceptually:

Frame does not need Port X
Do not transmit on Port X

This is one reason switches are more efficient than hubs.

Use:

Frame Arrives
Learn Source MAC
Destination Broadcast?
Yes → Flood
No
Destination MAC Known?
No → Unknown Unicast Flood
Yes
Destination on Same Incoming Port?
Yes → Filter
No → Forward to Known Port

58. Inspect Packet Capture During Switching

Section titled “58. Inspect Packet Capture During Switching”

Wireshark on one endpoint normally only shows frames visible to that endpoint’s virtual/physical interface.

You may not see all switch-port forwarding behavior unless:

Port Mirroring
SPAN
Virtual-Switch Capture
Simulator Packet Mode

is enabled.

This is expected.

Port mirroring copies traffic from selected switch ports or VLANs to an analysis port.

Conceptually:

Production Port
Switch
Mirror Copy
Analyzer / Wireshark

This supports monitoring and troubleshooting.

Depending on your platform, configure a mirror/SPAN session to copy selected lab traffic to the analyst interface.

Do not mirror unnecessary traffic in production environments without authorization and capacity planning.

If supported, capture traffic between:

CLIENT01
SERVER01

from NETPLUS-ADMIN.

Verify:

Source MAC
Destination MAC
Protocol
Source IP
Destination IP

62. Troubleshooting Scenario — Endpoint Up but Switch Port Down

Section titled “62. Troubleshooting Scenario — Endpoint Up but Switch Port Down”

Symptoms:

Endpoint Interface:
Appears Enabled
Switch Interface:
Down

Investigate:

Virtual Cable
Physical Cable
Switch Port State
NIC
Hypervisor Attachment

63. Troubleshooting Scenario — Switch Port Up but No IP Connectivity

Section titled “63. Troubleshooting Scenario — Switch Port Up but No IP Connectivity”

If:

Port:
Up

but:

Ping:
Fails

Layer 1/2 connectivity may be present.

Investigate next:

IP Address
Subnet Mask
ARP
Firewall
VLAN

64. Troubleshooting Scenario — MAC Learned but Ping Fails

Section titled “64. Troubleshooting Scenario — MAC Learned but Ping Fails”

If the switch has learned:

SERVER01 MAC → Port 3

this indicates Layer 2 frames are reaching the switch from SERVER01.

But IP communication can still fail because of:

Wrong IP
Wrong Subnet Mask
Firewall
Duplicate IP
Application Problem

Do not stop troubleshooting at the MAC table.

65. Troubleshooting Scenario — No MAC Learned

Section titled “65. Troubleshooting Scenario — No MAC Learned”

If no MAC is learned on a port:

No Frames Received

may be occurring.

Investigate:

Port Down
Endpoint Down
Cable Disconnected
Wrong Virtual Switch
NIC Disabled
No Traffic Generated

Use:

Layer 1
Link Present?
Layer 2
MAC Learned?
Layer 3
IP Correct?
Layer 4+
Service Working?

Document:

Switch Name:
NETPLUS-SW01
Management Address:
<if configured>
Ports Used:
1–3
VLAN:
Default / Lab VLAN
MAC Aging:
<value>
Port Status:
<details>

Clear dynamic MAC entries.

Generate traffic:

ADMIN → CLIENT01
CLIENT01 → SERVER01
SERVER01 → ADMIN

After each exchange, record the MAC table.

Your goal is to demonstrate:

Source Traffic
MAC Learning

69. Mission Challenge — Forwarding Decision

Section titled “69. Mission Challenge — Forwarding Decision”

Given:

MAC-A → Port 1
MAC-B → Port 2
MAC-C → Port 3

A frame arrives:

Incoming:
Port 1
Source:
MAC-A
Destination:
MAC-C

Answer:

Forward to Port 3

A frame arrives:

Incoming:
Port 1
Source:
MAC-A
Destination:
MAC-X

MAC-X is not in the table.

Expected:

Flood to other ports in the VLAN

Frame destination:

ff:ff:ff:ff:ff:ff

Expected:

Flood to all other ports in same VLAN

72. Mission Challenge — Collision Domains

Section titled “72. Mission Challenge — Collision Domains”

Given:

3 endpoints
connected to
3 separate switch ports

How many collision domains?

Answer:

3

assuming normal switched Ethernet operation.

73. Mission Challenge — Broadcast Domains

Section titled “73. Mission Challenge — Broadcast Domains”

All three switch ports are in the same VLAN.

How many broadcast domains?

Answer:

1

74. Mission Challenge — Interface Troubleshooting

Section titled “74. Mission Challenge — Interface Troubleshooting”

SERVER01 becomes unreachable.

You discover:

Switch Port 3:
Administratively Down

Your resolution:

Re-enable Port
Verify Link
Verify MAC Learning
Verify IP Connectivity

Move CLIENT01 to another switch port.

Record:

Old Port:
New Port:
MAC Before:
MAC After:
Time to Relearn:
Connectivity Result:

On NETPLUS-ADMIN:

Terminal window
mkdir -p ~/NetworkPlus-Labs/LAB06/{Captures,Screenshots,Configs,Notes}

Create:

Terminal window
touch ~/NetworkPlus-Labs/LAB06/Notes/lab06-notes.md

Where supported, save outputs such as:

show mac address-table
show interfaces status
show interfaces

Store in:

~/NetworkPlus-Labs/LAB06/Configs/

Use:

# LAB06 — Ethernet Switching Fundamentals
## Switch
Name:
NETPLUS-SW01
## Port Mapping
### Port 1
Device:
MAC:
Status:
Speed:
Duplex:
### Port 2
Device:
MAC:
Status:
Speed:
Duplex:
### Port 3
Device:
MAC:
Status:
Speed:
Duplex:
## MAC Address Table
ADMIN:
CLIENT01:
SERVER01:
## MAC Learning
Describe how each MAC was learned.
## Known Unicast
Source:
Destination:
Incoming Port:
Outgoing Port:
## Unknown Unicast
Observed / Conceptual Behavior:
## Broadcast
Broadcast MAC:
Forwarding Behavior:
## Collision Domains
Count:
Explanation:
## Broadcast Domains
Count:
Explanation:
## Troubleshooting
### Disabled Port
Problem:
Root Cause:
Fix:
Verification:
### Host Move
Old Port:
New Port:
MAC Relearned:
## Final Assessment
Summarize how NETPLUS-SW01 learns and forwards Ethernet traffic.

Capture:

01-switch-topology.png
02-endpoint-mac-addresses.png
03-empty-mac-table.png
04-admin-mac-learned.png
05-client-mac-learned.png
06-server-mac-learned.png
07-complete-mac-table.png
08-known-unicast-frame.png
09-arp-broadcast.png
10-broadcast-destination-mac.png
11-interface-status.png
12-speed-duplex.png
13-port-down.png
14-ping-failure.png
15-port-restored.png
16-connectivity-restored.png
17-host-port-move.png
18-mac-relearned.png
19-switch-baseline.png
20-final-topology.png
  • NETPLUS-SW01 created

  • ADMIN connected

  • CLIENT01 connected

  • SERVER01 connected

  • All interfaces verified

  • Endpoint MAC addresses recorded

  • Dynamic MAC table reviewed

  • MAC table cleared safely

  • ADMIN MAC learned

  • CLIENT01 MAC learned

  • SERVER01 MAC learned

  • Source-MAC learning understood

  • Known unicast forwarding understood

  • Unknown unicast flooding understood

  • Broadcast flooding understood

  • Frame filtering understood

  • Forwarding decision process documented

  • Collision domains understood

  • Broadcast domains understood

  • Switch vs hub understood

  • Unicast understood

  • Broadcast understood

  • MAC aging understood

  • Dynamic vs static MAC concepts understood

  • Interface status reviewed

  • Speed reviewed

  • Duplex reviewed

  • Full duplex understood

  • Auto-negotiation understood

  • Administratively down state understood

  • Disabled-port scenario completed

  • Port restored

  • Cable/virtual-link scenario understood

  • Missing-MAC scenario investigated

  • MAC-learned-but-IP-fails scenario understood

  • Host move completed

  • MAC relearning observed

  • Wireshark Ethernet frames reviewed

  • ARP broadcast captured

  • Source/destination MAC verified

  • Port-mirroring concept understood

  • Port map created

  • MAC table documented

  • Switch baseline created

  • Evidence captured

  • Lab notes completed

In this mission, you moved from understanding individual Ethernet frames to understanding how a switch handles them.

The switching process is:

Ethernet Frame Arrives
Learn Source MAC
Inspect Destination MAC
Known?
┌────┴────┐
Yes No
↓ ↓
Forward Flood
Correct Port

Broadcast traffic follows:

Broadcast Frame
Switch
Flood Within VLAN

You also learned the important distinction:

Switch Port
Separate Collision Domain

while:

Multiple Ports in Same VLAN
Same Broadcast Domain

The key lesson is:

A switch makes intelligent Layer 2 forwarding decisions by learning where source MAC addresses are located and then using its MAC address table to send known unicast traffic only where it needs to go.

After completing this mission, you should be able to:

  • explain Ethernet switching

  • identify switch ports

  • read a MAC address table

  • explain source-MAC learning

  • explain known unicast forwarding

  • explain unknown unicast flooding

  • explain broadcast forwarding

  • explain frame filtering

  • distinguish hubs and switches

  • identify collision domains

  • identify broadcast domains

  • understand full and half duplex

  • understand speed and duplex negotiation

  • inspect interface states

  • recognize administratively down ports

  • understand MAC aging

  • understand MAC moves

  • recognize MAC flapping conceptually

  • troubleshoot basic switching problems

Lab 07 — VLAN Configuration and Inter-VLAN Connectivity

Section titled “Lab 07 — VLAN Configuration and Inter-VLAN Connectivity”

You now have one switched network:

ADMIN
CLIENT01
SERVER01
Same Switch
Same Broadcast Domain

The next mission introduces VLANs to logically separate that network.

You will configure:

  • VLAN IDs

  • access ports

  • VLAN membership

  • VLAN segmentation

  • broadcast-domain separation

  • 802.1Q trunking

  • tagged Ethernet frames

  • native VLAN concepts

  • VLAN verification

  • inter-VLAN routing

  • default gateways

  • router-on-a-stick concepts

  • Layer 3 switch concepts

  • VLAN mismatch troubleshooting

  • trunk troubleshooting

The progression becomes:

Ethernet Switch
One Broadcast Domain
VLANs
Multiple Broadcast Domains
802.1Q Trunks
Layer 3 Routing
Inter-VLAN Connectivity

➡️ Next: Lab 07 — VLAN Configuration and Inter-VLAN Connectivity