Switch and mac address table












3















I thought that a switch learnt the mac addresses by the computers sending out packets. However when I configured 2 switches, and 2 pc's, 1 pc connected to 1 switch, the other pc connected to the other switch, and then both switches connected to each other, there were mac addresses in the mac address table without there being any packets being sent. Why/How does this happen?










share|improve this question


















  • 4





    PCs are actually pretty chatty. They do a lot of things in the background.

    – Ron Trunk
    Feb 13 at 11:56






  • 1





    Are you sure there were no packet sent? How? Modern OSes have a lot of background network activity. This can also be due to gratuitous ARP. See this answer for example

    – JFL
    Feb 13 at 11:57













  • Definitely no packets sent when it was first viewed, packets were sent afterwards and the table was view again.

    – The_Bear
    Feb 13 at 11:58






  • 4





    Then you have magic switches.

    – JFL
    Feb 13 at 13:02






  • 6





    Clearly the PCs sent frames. That’s how the switch learned the MACs.

    – Ron Trunk
    Feb 13 at 13:11
















3















I thought that a switch learnt the mac addresses by the computers sending out packets. However when I configured 2 switches, and 2 pc's, 1 pc connected to 1 switch, the other pc connected to the other switch, and then both switches connected to each other, there were mac addresses in the mac address table without there being any packets being sent. Why/How does this happen?










share|improve this question


















  • 4





    PCs are actually pretty chatty. They do a lot of things in the background.

    – Ron Trunk
    Feb 13 at 11:56






  • 1





    Are you sure there were no packet sent? How? Modern OSes have a lot of background network activity. This can also be due to gratuitous ARP. See this answer for example

    – JFL
    Feb 13 at 11:57













  • Definitely no packets sent when it was first viewed, packets were sent afterwards and the table was view again.

    – The_Bear
    Feb 13 at 11:58






  • 4





    Then you have magic switches.

    – JFL
    Feb 13 at 13:02






  • 6





    Clearly the PCs sent frames. That’s how the switch learned the MACs.

    – Ron Trunk
    Feb 13 at 13:11














3












3








3








I thought that a switch learnt the mac addresses by the computers sending out packets. However when I configured 2 switches, and 2 pc's, 1 pc connected to 1 switch, the other pc connected to the other switch, and then both switches connected to each other, there were mac addresses in the mac address table without there being any packets being sent. Why/How does this happen?










share|improve this question














I thought that a switch learnt the mac addresses by the computers sending out packets. However when I configured 2 switches, and 2 pc's, 1 pc connected to 1 switch, the other pc connected to the other switch, and then both switches connected to each other, there were mac addresses in the mac address table without there being any packets being sent. Why/How does this happen?







switch mac-address






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Feb 13 at 11:54









The_BearThe_Bear

714




714








  • 4





    PCs are actually pretty chatty. They do a lot of things in the background.

    – Ron Trunk
    Feb 13 at 11:56






  • 1





    Are you sure there were no packet sent? How? Modern OSes have a lot of background network activity. This can also be due to gratuitous ARP. See this answer for example

    – JFL
    Feb 13 at 11:57













  • Definitely no packets sent when it was first viewed, packets were sent afterwards and the table was view again.

    – The_Bear
    Feb 13 at 11:58






  • 4





    Then you have magic switches.

    – JFL
    Feb 13 at 13:02






  • 6





    Clearly the PCs sent frames. That’s how the switch learned the MACs.

    – Ron Trunk
    Feb 13 at 13:11














  • 4





    PCs are actually pretty chatty. They do a lot of things in the background.

    – Ron Trunk
    Feb 13 at 11:56






  • 1





    Are you sure there were no packet sent? How? Modern OSes have a lot of background network activity. This can also be due to gratuitous ARP. See this answer for example

    – JFL
    Feb 13 at 11:57













  • Definitely no packets sent when it was first viewed, packets were sent afterwards and the table was view again.

    – The_Bear
    Feb 13 at 11:58






  • 4





    Then you have magic switches.

    – JFL
    Feb 13 at 13:02






  • 6





    Clearly the PCs sent frames. That’s how the switch learned the MACs.

    – Ron Trunk
    Feb 13 at 13:11








4




4





PCs are actually pretty chatty. They do a lot of things in the background.

– Ron Trunk
Feb 13 at 11:56





PCs are actually pretty chatty. They do a lot of things in the background.

– Ron Trunk
Feb 13 at 11:56




1




1





Are you sure there were no packet sent? How? Modern OSes have a lot of background network activity. This can also be due to gratuitous ARP. See this answer for example

– JFL
Feb 13 at 11:57







Are you sure there were no packet sent? How? Modern OSes have a lot of background network activity. This can also be due to gratuitous ARP. See this answer for example

– JFL
Feb 13 at 11:57















Definitely no packets sent when it was first viewed, packets were sent afterwards and the table was view again.

– The_Bear
Feb 13 at 11:58





Definitely no packets sent when it was first viewed, packets were sent afterwards and the table was view again.

– The_Bear
Feb 13 at 11:58




4




4





Then you have magic switches.

– JFL
Feb 13 at 13:02





Then you have magic switches.

– JFL
Feb 13 at 13:02




6




6





Clearly the PCs sent frames. That’s how the switch learned the MACs.

– Ron Trunk
Feb 13 at 13:11





Clearly the PCs sent frames. That’s how the switch learned the MACs.

– Ron Trunk
Feb 13 at 13:11










3 Answers
3






active

oldest

votes


















5














When you connect a PC to a network switch ("link up"), the PC performs at least one of these procedures (assuming IPv4 use):




  1. (most commonly) request an IP address lease from a DHCP server

  2. (when DHCP fails or is deactivated) automatically configure a link-local IP address (aka zero-config or APIPA)

  3. (when a static IP address is configured) send an ARP probe to detect an address collision


All of these methods send out broadcast frames from the PC which populate the MAC table in all the switches in the network (broadcast domain / VLAN).






share|improve this answer


























  • Also, gratuitous ARP, as mentioned in the comments to the question.

    – Jörg W Mittag
    Feb 13 at 20:17











  • And an ARP for the default gateway and DNS servers if defined either locally or by DHCP plus UPNP discovery, etc.

    – grahamj42
    Feb 13 at 20:20











  • Strictly speaking this depend on OS and network configuration. If you were to disable IPv4 none of the packets you mention would be sent. For another example look at IPv6, it doesn't use broadcast only multicast. There are switches which will treat them the same, but a switch does not have to forward multicast packets onto all ports.

    – kasperd
    Feb 13 at 22:20











  • @kasperd Absolutely. However, 99.x% of users are using IPv4 and the question didn't call for a too thorough/complicated answer.

    – Zac67
    Feb 14 at 7:21











  • @Zac67 Your 99% number sounds like one you made up rather than anything based on actual data. One would need telemetry implemented in native code deployed to a very large user base to give a number with that amount of accuracy. I most certainly don't have access to a large enough number of client machines to say how widespread the use of IPv6-only networks with NAT64 is. But given that more than 20% of users have IPv6 access I would guess the number of such IPv6-only networks to amount for more than 1%.

    – kasperd
    Feb 14 at 21:20



















4














PCs have many background tasks that send data all the time, even when you’re “not doing anything.” These frames will populate the MAC table.






share|improve this answer































    1














    You might think no packets have been sent, but Computers do a lot of talking in the background, given all the services functioning in the background.






    share|improve this answer
























      protected by Ron Maupin Feb 13 at 21:16



      Thank you for your interest in this question.
      Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).



      Would you like to answer one of these unanswered questions instead?














      3 Answers
      3






      active

      oldest

      votes








      3 Answers
      3






      active

      oldest

      votes









      active

      oldest

      votes






      active

      oldest

      votes









      5














      When you connect a PC to a network switch ("link up"), the PC performs at least one of these procedures (assuming IPv4 use):




      1. (most commonly) request an IP address lease from a DHCP server

      2. (when DHCP fails or is deactivated) automatically configure a link-local IP address (aka zero-config or APIPA)

      3. (when a static IP address is configured) send an ARP probe to detect an address collision


      All of these methods send out broadcast frames from the PC which populate the MAC table in all the switches in the network (broadcast domain / VLAN).






      share|improve this answer


























      • Also, gratuitous ARP, as mentioned in the comments to the question.

        – Jörg W Mittag
        Feb 13 at 20:17











      • And an ARP for the default gateway and DNS servers if defined either locally or by DHCP plus UPNP discovery, etc.

        – grahamj42
        Feb 13 at 20:20











      • Strictly speaking this depend on OS and network configuration. If you were to disable IPv4 none of the packets you mention would be sent. For another example look at IPv6, it doesn't use broadcast only multicast. There are switches which will treat them the same, but a switch does not have to forward multicast packets onto all ports.

        – kasperd
        Feb 13 at 22:20











      • @kasperd Absolutely. However, 99.x% of users are using IPv4 and the question didn't call for a too thorough/complicated answer.

        – Zac67
        Feb 14 at 7:21











      • @Zac67 Your 99% number sounds like one you made up rather than anything based on actual data. One would need telemetry implemented in native code deployed to a very large user base to give a number with that amount of accuracy. I most certainly don't have access to a large enough number of client machines to say how widespread the use of IPv6-only networks with NAT64 is. But given that more than 20% of users have IPv6 access I would guess the number of such IPv6-only networks to amount for more than 1%.

        – kasperd
        Feb 14 at 21:20
















      5














      When you connect a PC to a network switch ("link up"), the PC performs at least one of these procedures (assuming IPv4 use):




      1. (most commonly) request an IP address lease from a DHCP server

      2. (when DHCP fails or is deactivated) automatically configure a link-local IP address (aka zero-config or APIPA)

      3. (when a static IP address is configured) send an ARP probe to detect an address collision


      All of these methods send out broadcast frames from the PC which populate the MAC table in all the switches in the network (broadcast domain / VLAN).






      share|improve this answer


























      • Also, gratuitous ARP, as mentioned in the comments to the question.

        – Jörg W Mittag
        Feb 13 at 20:17











      • And an ARP for the default gateway and DNS servers if defined either locally or by DHCP plus UPNP discovery, etc.

        – grahamj42
        Feb 13 at 20:20











      • Strictly speaking this depend on OS and network configuration. If you were to disable IPv4 none of the packets you mention would be sent. For another example look at IPv6, it doesn't use broadcast only multicast. There are switches which will treat them the same, but a switch does not have to forward multicast packets onto all ports.

        – kasperd
        Feb 13 at 22:20











      • @kasperd Absolutely. However, 99.x% of users are using IPv4 and the question didn't call for a too thorough/complicated answer.

        – Zac67
        Feb 14 at 7:21











      • @Zac67 Your 99% number sounds like one you made up rather than anything based on actual data. One would need telemetry implemented in native code deployed to a very large user base to give a number with that amount of accuracy. I most certainly don't have access to a large enough number of client machines to say how widespread the use of IPv6-only networks with NAT64 is. But given that more than 20% of users have IPv6 access I would guess the number of such IPv6-only networks to amount for more than 1%.

        – kasperd
        Feb 14 at 21:20














      5












      5








      5







      When you connect a PC to a network switch ("link up"), the PC performs at least one of these procedures (assuming IPv4 use):




      1. (most commonly) request an IP address lease from a DHCP server

      2. (when DHCP fails or is deactivated) automatically configure a link-local IP address (aka zero-config or APIPA)

      3. (when a static IP address is configured) send an ARP probe to detect an address collision


      All of these methods send out broadcast frames from the PC which populate the MAC table in all the switches in the network (broadcast domain / VLAN).






      share|improve this answer















      When you connect a PC to a network switch ("link up"), the PC performs at least one of these procedures (assuming IPv4 use):




      1. (most commonly) request an IP address lease from a DHCP server

      2. (when DHCP fails or is deactivated) automatically configure a link-local IP address (aka zero-config or APIPA)

      3. (when a static IP address is configured) send an ARP probe to detect an address collision


      All of these methods send out broadcast frames from the PC which populate the MAC table in all the switches in the network (broadcast domain / VLAN).







      share|improve this answer














      share|improve this answer



      share|improve this answer








      edited Feb 14 at 7:21

























      answered Feb 13 at 13:45









      Zac67Zac67

      29.6k21859




      29.6k21859













      • Also, gratuitous ARP, as mentioned in the comments to the question.

        – Jörg W Mittag
        Feb 13 at 20:17











      • And an ARP for the default gateway and DNS servers if defined either locally or by DHCP plus UPNP discovery, etc.

        – grahamj42
        Feb 13 at 20:20











      • Strictly speaking this depend on OS and network configuration. If you were to disable IPv4 none of the packets you mention would be sent. For another example look at IPv6, it doesn't use broadcast only multicast. There are switches which will treat them the same, but a switch does not have to forward multicast packets onto all ports.

        – kasperd
        Feb 13 at 22:20











      • @kasperd Absolutely. However, 99.x% of users are using IPv4 and the question didn't call for a too thorough/complicated answer.

        – Zac67
        Feb 14 at 7:21











      • @Zac67 Your 99% number sounds like one you made up rather than anything based on actual data. One would need telemetry implemented in native code deployed to a very large user base to give a number with that amount of accuracy. I most certainly don't have access to a large enough number of client machines to say how widespread the use of IPv6-only networks with NAT64 is. But given that more than 20% of users have IPv6 access I would guess the number of such IPv6-only networks to amount for more than 1%.

        – kasperd
        Feb 14 at 21:20



















      • Also, gratuitous ARP, as mentioned in the comments to the question.

        – Jörg W Mittag
        Feb 13 at 20:17











      • And an ARP for the default gateway and DNS servers if defined either locally or by DHCP plus UPNP discovery, etc.

        – grahamj42
        Feb 13 at 20:20











      • Strictly speaking this depend on OS and network configuration. If you were to disable IPv4 none of the packets you mention would be sent. For another example look at IPv6, it doesn't use broadcast only multicast. There are switches which will treat them the same, but a switch does not have to forward multicast packets onto all ports.

        – kasperd
        Feb 13 at 22:20











      • @kasperd Absolutely. However, 99.x% of users are using IPv4 and the question didn't call for a too thorough/complicated answer.

        – Zac67
        Feb 14 at 7:21











      • @Zac67 Your 99% number sounds like one you made up rather than anything based on actual data. One would need telemetry implemented in native code deployed to a very large user base to give a number with that amount of accuracy. I most certainly don't have access to a large enough number of client machines to say how widespread the use of IPv6-only networks with NAT64 is. But given that more than 20% of users have IPv6 access I would guess the number of such IPv6-only networks to amount for more than 1%.

        – kasperd
        Feb 14 at 21:20

















      Also, gratuitous ARP, as mentioned in the comments to the question.

      – Jörg W Mittag
      Feb 13 at 20:17





      Also, gratuitous ARP, as mentioned in the comments to the question.

      – Jörg W Mittag
      Feb 13 at 20:17













      And an ARP for the default gateway and DNS servers if defined either locally or by DHCP plus UPNP discovery, etc.

      – grahamj42
      Feb 13 at 20:20





      And an ARP for the default gateway and DNS servers if defined either locally or by DHCP plus UPNP discovery, etc.

      – grahamj42
      Feb 13 at 20:20













      Strictly speaking this depend on OS and network configuration. If you were to disable IPv4 none of the packets you mention would be sent. For another example look at IPv6, it doesn't use broadcast only multicast. There are switches which will treat them the same, but a switch does not have to forward multicast packets onto all ports.

      – kasperd
      Feb 13 at 22:20





      Strictly speaking this depend on OS and network configuration. If you were to disable IPv4 none of the packets you mention would be sent. For another example look at IPv6, it doesn't use broadcast only multicast. There are switches which will treat them the same, but a switch does not have to forward multicast packets onto all ports.

      – kasperd
      Feb 13 at 22:20













      @kasperd Absolutely. However, 99.x% of users are using IPv4 and the question didn't call for a too thorough/complicated answer.

      – Zac67
      Feb 14 at 7:21





      @kasperd Absolutely. However, 99.x% of users are using IPv4 and the question didn't call for a too thorough/complicated answer.

      – Zac67
      Feb 14 at 7:21













      @Zac67 Your 99% number sounds like one you made up rather than anything based on actual data. One would need telemetry implemented in native code deployed to a very large user base to give a number with that amount of accuracy. I most certainly don't have access to a large enough number of client machines to say how widespread the use of IPv6-only networks with NAT64 is. But given that more than 20% of users have IPv6 access I would guess the number of such IPv6-only networks to amount for more than 1%.

      – kasperd
      Feb 14 at 21:20





      @Zac67 Your 99% number sounds like one you made up rather than anything based on actual data. One would need telemetry implemented in native code deployed to a very large user base to give a number with that amount of accuracy. I most certainly don't have access to a large enough number of client machines to say how widespread the use of IPv6-only networks with NAT64 is. But given that more than 20% of users have IPv6 access I would guess the number of such IPv6-only networks to amount for more than 1%.

      – kasperd
      Feb 14 at 21:20











      4














      PCs have many background tasks that send data all the time, even when you’re “not doing anything.” These frames will populate the MAC table.






      share|improve this answer




























        4














        PCs have many background tasks that send data all the time, even when you’re “not doing anything.” These frames will populate the MAC table.






        share|improve this answer


























          4












          4








          4







          PCs have many background tasks that send data all the time, even when you’re “not doing anything.” These frames will populate the MAC table.






          share|improve this answer













          PCs have many background tasks that send data all the time, even when you’re “not doing anything.” These frames will populate the MAC table.







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered Feb 13 at 13:22









          Ron TrunkRon Trunk

          36.7k33475




          36.7k33475























              1














              You might think no packets have been sent, but Computers do a lot of talking in the background, given all the services functioning in the background.






              share|improve this answer






























                1














                You might think no packets have been sent, but Computers do a lot of talking in the background, given all the services functioning in the background.






                share|improve this answer




























                  1












                  1








                  1







                  You might think no packets have been sent, but Computers do a lot of talking in the background, given all the services functioning in the background.






                  share|improve this answer















                  You might think no packets have been sent, but Computers do a lot of talking in the background, given all the services functioning in the background.







                  share|improve this answer














                  share|improve this answer



                  share|improve this answer








                  edited Feb 13 at 17:57









                  Cown

                  6,26131030




                  6,26131030










                  answered Feb 13 at 17:16









                  PantheraPanthera

                  111




                  111

















                      protected by Ron Maupin Feb 13 at 21:16



                      Thank you for your interest in this question.
                      Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).



                      Would you like to answer one of these unanswered questions instead?



                      Popular posts from this blog

                      How to change which sound is reproduced for terminal bell?

                      Title Spacing in Bjornstrup Chapter, Removing Chapter Number From Contents

                      Can I use Tabulator js library in my java Spring + Thymeleaf project?