Switches and Ethernet

Ethernet is the dominant wired link-layer technology. Data travels in frames, and the device that moves them around a LAN is a switch.

The Ethernet frame

A frame wraps the network-layer packet with a link-layer header and trailer:

Field	Size	Purpose
Preamble	8 bytes	Sync the receiver's clock; mark the start of a frame
Destination MAC	6 bytes	Which interface on this link should receive the frame
Source MAC	6 bytes	Which interface sent it (how switches self-learn)
Type	2 bytes	Which protocol is inside (0x0800 = IPv4, 0x0806 = ARP, 0x86DD = IPv6)
Payload	46-1500 bytes	The network-layer packet (padded up to the 46-byte minimum)
FCS	4 bytes	Frame Check Sequence - a CRC over the frame for error detection

The receiver recomputes the CRC over the frame and compares it to the FCS; a mismatch means the frame is corrupt and gets dropped silently.

Hubs versus switches

An old hub is a dumb repeater: bits arriving on one port are blasted out every other port. All ports share one collision domain, so hosts must contend for the medium with CSMA/CD, and traffic between any two hosts is seen by all.

A switch is smarter. It reads each frame's destination MAC and forwards it out only the port leading toward that host. Each port is its own collision domain (usually just the switch and one host, so full-duplex with no collisions at all), and hosts no longer compete for a shared wire.

The self-learning forwarding table

A switch is not configured with which host lives on which port - it learns by watching traffic:

• When a frame arrives, the switch records its source MAC and the port it came in on. That is now a forwarding-table entry (with a timestamp so it can expire).
• To forward, it looks up the frame's destination MAC. A hit means send it out just that one port. A miss means flood - send it out every port except the one it arrived on - so it still reaches the destination, and the reply teaches the switch where that host is.

tip

Every frame advertises its sender: the source MAC plus the arrival port is a free MAC -> port lesson. The switch never needs to learn destinations directly - it floods unknown ones once, and the resulting reply frame carries the source MAC that fills in the missing entry. A few frames in, the table is populated and flooding stops.

Collision domains versus broadcast domains

These two are easy to mix up:

• A collision domain is the set of interfaces whose frames can collide with each other. A hub is one big collision domain; each switch port is its own.
• A broadcast domain is the set of interfaces a broadcast frame (destination MAC ff:ff:ff:ff:ff:ff) reaches. A switch floods broadcasts out every port, so a plain switch is a single broadcast domain no matter how many ports it has.

Switches shrink collision domains to almost nothing but leave the broadcast domain whole. Breaking up that broadcast domain is exactly what VLANs and routers do.

Multiple access: how a shared medium used to be arbitrated

A switched LAN gives every port its own collision domain, so nothing needs to be arbitrated - but a hub, an old coax Ethernet bus, and a WiFi channel are all broadcast links: many hosts share one medium, and two hosts transmitting at once destroy both signals. Deciding who gets to talk, and when on such a link is the multiple access problem. Approaches fall into three families:

Approach	Idea	Strength	Weakness
Channel partitioning	Slice the channel into fixed pieces, one per host (TDMA by time slot, FDMA by frequency band)	No collisions; fair, guaranteed share	Idle hosts waste their slice; a host waits its turn even when alone
Random access	Transmit whenever you have data; detect and recover from the collisions that result (CSMA/CD, CSMA/CA, ALOHA)	A lone host gets the full channel; simple	Collisions waste bandwidth as load rises
Taking turns	Hosts coordinate turns - polling by a controller, or passing a token around the ring	Efficient at high load, no collisions	Polling/token overhead and latency; single point of failure

Classic wired Ethernet on a hub used CSMA/CD - Carrier Sense Multiple Access with Collision Detection - random access with cleanup:

1. Carrier sense - listen before transmitting. If the channel is busy, wait.
2. Collision detection - keep listening while transmitting. If you hear a collision, stop immediately instead of wasting time finishing a doomed frame.
3. Backoff - after a collision, wait a random, exponentially growing amount of time before retrying, so the same hosts do not keep colliding.

info

Carrier sense is not enough because signals travel at finite speed. Host A can sense the channel idle and start sending; A's signal has not yet reached distant host B, so B also senses idle and transmits - and the two collide midway. This vulnerable window is why CSMA/CD sets a minimum frame size and a maximum cable length.

For classic 10 Mbps Ethernet over a 2500-meter maximum-diameter network, the round-trip propagation delay works out to about 51.2 microseconds - that "slot time" is why the standard sets the minimum frame size at 64 bytes (512 bits): at 10 Mbps, 512 bits take exactly 51.2 microseconds to transmit, so a sender is still transmitting when a far-end collision signal could get back to it, guaranteeing it detects the collision instead of finishing the frame and moving on none the wiser. Shrink the frame below that and a collision could arrive after the sender already believes it succeeded.

WiFi cannot reliably detect a collision while sending its own much louder signal, so it uses CSMA/CA instead - avoidance via random backoff plus acknowledgements, covered in Wireless Links & 802.11 WiFi.

⚠Duplex mismatch causes silent, one-sided packet loss

A link where one end auto-negotiates to half-duplex and the other is hard-set to full-duplex (a common misconfiguration when someone manually pins speed/duplex on an old switch port or NIC) does not fail to link up - it links up fine and looks healthy. But the half-duplex side still runs CSMA/CD and treats an inbound frame arriving while it is transmitting as a collision, while the full-duplex side never expects collisions at all and just sends whenever it has data. The result is late collisions and runt/CRC-error frames that show up only under load, causing retransmissions and throughput that can crawl to a fraction of the link's rated speed - a classic "it's slow but the link light is green" incident that duplex mismatch counters on the switch (not ping, which is small and infrequent enough to hide the problem) will reveal.