Ethernet – How does the switch analyse the EtherType field in Ethernet frame

Detecting link on a port is not done using ethernet frames, but with electrical pulses known as normal link pulses. If no frames are being sent, a device puts these on the wire every 16 ms (+/- 8 ms). They are also used for autonegotiation.

A link is considered down if no frames and no pulses are received. Receiving the pulses will make a Cisco tell you the port is up, but as we all know, it is perfectly possible to have "FastEthernet0/0 is up, line protocol is down".

The normal link pulses are not frames, and will not be forwarded by hubs or switches.

Keepalive frames are forwarded or switched, and can be used to detect a loop.

Layer 2 switches (bridges) have a MAC address table that contains a MAC address and port number. Switches follow this simple algorithm for forwarding packets:

1. When a frame is received, the switch compares the SOURCE MAC address to the MAC address table. If the SOURCE is unknown, the switch adds it to the table along with the port number the packet was received on. In this way, the switch learns the MAC address and port of every transmitting device.

2. The switch then compares the DESTINATION MAC address with the table. If there is an entry, the switch forwards the frame out the associated port. If there is no entry, the switch sends the packet out all its ports, except the port that the frame was received on (Flooding).

Note that the switch does not learn the destination MAC until it receives a frame from that device.