Ethernet Frame Minimum Size

• Minimum size per Ethernet Frame is 46 Bytes.
• If an Ethernet frame is sent that is less than 46 bytes, padding bytes (all zeros) are added.
  • For example, if a 34-byte packet is sent, 12 bytes are added to reach 46 bytes.
• 64 bytes is the minimum size of an Ethernet frame when including the preamble and SFD.
• Usually, the preamble and SFD are not considered parts of the Ethernet Frame, thus making the minimum size 46 bytes.
• The topology is the same as before, but with Interface G0/0 instead of f0/1, so instead of fastethernet we use G0/0.
• There are IP addresses for the network and corresponding IP addresses for each PC.

MAC Addresses and IP

• When a device sends data to another, it includes source and destination MAC addresses. Encapsulated within that frame is the IP (Internet Protocol).
• The IP packet contains source and destination IP addresses.
• For example, if PC1 sends data to PC3, the switches use Layer 2 devices operating based on MAC addresses.
• PC1 needs to learn PC3's MAC address to send a frame, achieved through ARP.

ARP (Address Resolution Protocol)

• Protocol to discover the MAC address of a known IP address.
• If the IP address of PC3 is known, PC1 uses an ARP Request to find the MAC address.

ARP Process - Involves 2 Messages:

• ARP Request - Sent by a device trying to learn the MAC address of another device.
• ARP Reply - Sent to inform the requesting device of the MAC address.
• PC1 sends an ARP Request, and PC3 sends an ARP Reply

Ethernet Frame Broadcast

• An ARP Request is sent as a Broadcast Ethernet Frame because the destination host's Layer 2 address is unknown.
• Logically, it is sent to all hosts to find the one with the IP address and get a MAC address response.
• An ARP Reply is Unicast, sent only to the host that made the request.

Example ARP Request

• Includes a source IP of 192.168.1.1 (PC1's IP) and a destination IP of 192.168.1.3 (the host MAC address that is needed).

• The source MAC address is PC1's MAC address.

• The destination MAC address is a broadcast address (FF:FF:FF:FF:FF:FF)

• It's sent to all hosts on the network

• The command arp -a views the ARP Table on Windows, Linux, and macOS.

• Internet Address represents the IP address (Layer 3).

• Physical Address represents the MAC address (Layer 2).

• A static type indicates a default entry, while dynamic means the entry was learned via an ARP Request and Reply.

• In the case of a router IP and MAC address, dynamic type means the PC sent an ARP Request and received an ARP Reply from the router, learning its MAC address.

PING (Packet InterNet Groper)

• A network utility to test reachability between two computers.
• Calculates round-trip time, such as from PC1 to PC3 and back.
• Uses ICMP (Internet Control Message Protocol)
  • ICMP Echo Request
  • ICMP Echo Reply
• The PC doesn't do broadcast ICMP Echo Requests since the ICMP Echo Request is sent to a specific host.
• To send an ICMP Echo Request, the sender needs to know the MAC address of the device to ping, which is why ARP is used initially.

Ping Command

• The command to use ping is ping (ip-address).
• For example: ping 192.168.1.1
• During a ping, the first packet may fail due to ARP since PC1 might not know the destination MAC address.
• PC1 then uses ARP and continues sending an ARP, so the initial ping fails.
• Once PC1 learns the MAC address of PC3, subsequent pings are successful.

Cisco IOS Command

• To view the ARP Table on Cisco IOS, use show arp.
• ARP Request in Wireshark shows the MAC address being broadcast by PC1, asking which device has the IP address 192.168.1.3.
• The MAC address of PC1 broadcasts an ARP Request.
• The reply from PC3 with IP 192.168.1.3 includes MAC address
• Initiates four ICMP echo request packets and four ICMP echo reply packets due to previous failure related to ARP.

Cisco MAC Address

• Use the show mac address-table command to show MAC address-table
  • The first row shows the VLAN (Virtual Local Area Network), default is typically 1.
  • The second row shows the MAC addresses of PC1 and PC3.
  • The Type indicates how the MAC addresses were learned, dynamically in this case.
  • The Ports row represents the interface.

Aging on the Network

• Aging refers to the process where the switch's MAC address table entries are removed after 5 minutes of inactivity.
• If a switch does not receive any traffic from a MAC address, it removes the MAC address data.
• The MAC address table of a switch can also removed manually by using the command clear mac address-table dynamic

Options to remove MAC addresses:

• Use the command SW1#clear mac address-table dynamic address and the specific address to remove a single MAC address.
• Type the command Use the same command, but use an specific interface: SW1#clear mac address-table dynamic interface Gi0/0