Suppose PC1 with IP address 1.1.1.1 and MAC address A.A.A.A wants to send a frame to PC2 with IP address 2.2.2.2 and MAC address B.B.B.B, plus there is a switch in the middle. PC1 doesn't know where is PC2 located so it will send an ARP REQUEST.
Now, when the ARP reaches the switch, the switch makes the decision of flooding all the ports except the one it came from, and when it does that the request will reach PC2 which will first add the IP and MAC addresses of the SRC to its ARP table, and then it will REPLY with its IP and
MAC addresses. After that the packet is sent.
Of course, the switch will direct the reply to PC1 because it knows its MAC address and IP address Of the SRC and DES.
Now, the BUM (Boradcast Unkown Unicast Multicast)
What I know is that (suppose having the same end points and switch) the switch uses this traffic to dynamically learn the which port belongs to which endpoint. Suppose the same case where PC1 wants to send a frame to PC2. PC1 frame has the SRC and DES IP and MAC addresses. The frame is sent, and when it reaches the switch, the switch looks into its CAM table to know which port belongs to which MAC address and if it doesn't find PC2 it will send the frame (WITH THE MAC AND IP ADDRESSES OF BOTH END POINTS) to all end devices
and PC2 will know that this IP address belongs to him PC2 will reply and when it does. I think it sends back the same frame (I am not sure but it will send back something whether a frame or a request that will tell the switch to register that port with its IP and MAC addresses).
I have came to my own conclusion that says the ARP protocol helps in saving the IP and MAC addresses of other machines (PC2 in this case) in its own ARP table. On the other hand, the switch uses the BUM traffic to fill up its own CAM table. (please correct me if am wrong)
What I am asking here is:
-
Is my explanation correct?
-
What are the main differences between them?
-
Can we use one of them only? because they seem to be doing the same task. If not why?
Please correct me if I got something wrong. I know whoever is going to answer me will have way way way more knowledge than me, so please share with me as much as you can because I have passion for what am trying to learn! 🙂
Best Answer
Switches operate at layer-2, e.g. ethernet, and they don't get involved with layer-3, e.g. IPv4, IPX, IPv6, AppleTalk, etc. This allows switches to switch traffic at layer-2 for any layer-3 protocol.
ARP is used by hosts to translate a layer-3 address to a layer-2 (MAC) address, so switches don't use ARP, nor are they even aware of the layer-3 addressing.
If a host doesn't have the layer-2 address for a particular layer-3 address in its ARP table, it will use ARP (broadcast) to discover the layer-2 address for that layer-3 address.
A switch has a MAC address table, not an ARP table like the hosts (except where it is a host for management purposes, but that has nothing to do with the switching function). While an ARP table can look up a layer-2 address from a layer-3 address, a switch MAC address table will look up a switch interface from a layer-2 address. Many people get this wrong.
If a switch doesn't have a layer-2 address in its MAC address table, then it will flood the frame to all interfaces, except the one where it entered the switch.
Switches will broadcast any frame with the broadcast layer-2 address to all switch interfaces, except the one where the frame entered the switch.
Multicast, at layer-2, where switches operate, is a form of broadcast, and multicast frames are treated like broadcasts. This has been mitigated by IGMP snooping in many new switches. This allows a switch to snoop on the IGMP requests by hosts to a multicast router. A switch with IGMP snooping enabled will learn and build a table of which interfaces have requested to join which IGMP groups, and it will only send traffic to those interfaces for that multicast group.
None of the switch behavior has anything to do with ARP or ARP tables in hosts.