Enter PIN to continue
Every network fault maps to a specific layer. If the symptom is "web page times out" the root cause could be a dying physical cable (layer 1), a bad ARP entry (layer 2), a missing route (layer 3), or a blocked TCP port (layer 4). Pinpointing the layer before troubleshooting saves hours of random checks.
| Layer | PDU name | Typical device |
|---|---|---|
| 1 — Physical | Bits | Repeater / Hub |
| 2 — Data Link | Frame | Switch / Bridge |
| 3 — Network | Packet | Router |
| 4 — Transport | Segment (TCP) / Datagram (UDP) | Firewall / Load Balancer |
| 5 — Session | Data (message) | — |
| 6 — Presentation | Data (message) | — |
| 7 — Application | Data (message) | Application / Browser |
Symptom: Browser reports "Connection refused", yet ping 10.1.1.1 succeeds.
Root cause: ping uses ICMP at layer 3 — it reaches the host. "Connection refused" is a TCP RST at layer 4 — the application port is not listening. The OS itself is alive; the service died.
Fix: Test the port: nc -zv 10.1.1.1 443. If closed, start the web server or check process.
Layer 3 (Network). The router reads the destination IP address to choose the outgoing interface — a network-layer decision. Switches use MAC addresses (layer 2).
Application layer — more precisely the Presentation layer (OSI 6), which is bundled into the TCP/IP Application layer. Transport security operates above TCP port 443 but the encryption is a session/presentation function from the OSI perspective.
ARP is carried inside an Ethernet frame, making it a frame-level PDU. It operates at layer 2 (Data Link) — it resolves IP (L3) to MAC (L2), so it straddles layers but is encapsulated as a frame and never leaves the broadcast domain.
An IPv4 address is not just a number — it carries a network prefix and a host suffix. The boundary between the two, set by the subnet mask, controls:
Poor planning wastes addresses (too large a mask = unused space) or forces renumbering later (too small = run out of host IPs).
Every IPv4 address is a 32‑bit integer displayed in dotted‑decimal:
192.168.1.10 → 11000000.10101000.00000001.00001010 <--- network portion (mask) ---> <------- host portion ------->
Classful addressing is obsolete — CIDR replaced it in 1993 — but the ranges still appear in route‑origin policies and legacy discussions.
| Class | First octet | Default mask | CIDR | Original purpose |
|---|---|---|---|---|
| A | 1 – 126 | 255.0.0.0 | /8 | ~16 million hosts |
| B | 128 – 191 | 255.255.0.0 | /16 | ~65,000 hosts |
| C | 192 – 223 | 255.255.255.0 | /24 | 254 usable hosts |
| D | 224 – 239 | — | — | Multicast group addresses |
| E | 240 – 255 | — | — | Experimental / reserved |
Note: 127.0.0.0/8 is loopback — packets to any 127.x.x.x never leave the host.
Three blocks cannot be routed on the public Internet. Border routers drop traffic with a private source IP unless NAT is active:
| Range | CIDR | Scope |
|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | Enterprise / campus |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | Mid-size |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | SOHO / lab |
Other reserved: 169.254.0.0/16 (APIPA — Windows self‑assigns when DHCP fails). 100.64.0.0/10 (Carrier‑Grade NAT, RFC 6598).
Every subnet has a broadcast address: all host bits set to 1. Sending to it reaches every host on that subnet.
Example: 10.10.0.0/16
Network: 00001010.00001010.00000000.00000000 = 10.10.0.0 Mask: 11111111.11111111.00000000.00000000 (16 bits fixed) Broadcast: 00001010.00001010.11111111.11111111 = 10.10.255.255 (flip host bits) -------------------- Usable hosts: 2^(32−16) − 2 = 65,536 − 2 = 65,534
Two types:
Limited broadcast (255.255.255.255) — never forwarded by a router.
Directed broadcast (10.10.255.255) — can be forwarded unless no ip directed‑broadcast is set, which is the default on modern IOS.
Class D addresses (224.0.0.0 – 239.255.255.255) send to a group, not a single host or all hosts. Routers use PIM to build distribution trees; hosts join groups with IGMP.
| Reserved address | Group |
|---|---|
| 224.0.0.1 | All hosts on subnet |
| 224.0.0.2 | All multicast routers |
| 224.0.0.5 / .6 | OSPF (all routers / DR-BDR) |
| 224.0.0.9 | EIGRP |
| 224.0.0.10 | HSRP version 2 |
No router forwards multicast by default — ip multicast‑routing must be enabled.
Symptom: Two hosts on the same switch cannot ping.
Check: One has 169.254.1.25 (APIPA — no DHCP), the other is 192.168.1.10. Different subnets, no router between them.
Fix: Static IP on same subnet, or restore DHCP server reachability.
Router# show ip interface brief Interface IP-Address OK? Method Status Protocol Gig0/0 192.168.1.1/24 YES manual up up Router# show ip interface gig0/0 Broadcast address is 255.255.255.255 Directed broadcast forwarding is disabled
/19 mask = 19 bits fixed → 13 host bits
172.20.0.0 = 10101100.00010100.00000000.00000000
broadcast = 10101100.00010100.00011111.11111111 (flip all host bits)
= 172.20.31.255Directed broadcast for the 10.0.0.0/8 network. The host sees 10.255.255.255 — all host bits are 1. The packet will reach all hosts on the 10.0.0.0/8 subnet if the intermediate routers permit directed‑broadcast forwarding (disabled by default).
No. 239.x.y.z is in the Administratively Scoped range (239.0.0.0/8) — it is never routed beyond an organization's boundary. Within the enterprise: IGMP (hosts tell the router they want the group) and PIM (routers build a distribution tree toward the source or the Rendezvous Point).
A /24 (255.255.255.0) gives 254 hosts. Most LANs need far fewer, so you subnet it to create multiple smaller networks. Every subnet consumes address space — the math must be exact or you run out of addresses or route table memory.
A /24 means 24 fixed network bits; the remaining 8 host bits can vary.
Mask /24 = 11111111.11111111.11111111.00000000
Split one /24 into four /26s (borrow 2 host bits):
Mask /26 = 11111111.11111111.11111111.11000000
^-- 2 borrowed bits = 2^(32-26) = 64 addresses per subnet
2 subnets worth? Actually 4 subnets (192,193,194,195 high octet slices):
192.168.0.0/26 (hosts .0 - .63, bcast .63)
192.168.0.64/26 (hosts .64 - .127, bcast .127)
192.168.0.128/26 (hosts .128 - .191, bcast .191)
192.168.0.192/26 (hosts .192 - .255, bcast .255)
Usable hosts = 2^(host bits) − 2 (subtract network & broadcast). So /26 → 64 − 2 = 62 usable hosts per subnet.
Given network 10.0.0.0/24, create 7 subnets for 7 VLANs. Each VLAN hosts 20 devices.
Step 1: need 20 hosts. 2^h − 2 ≥ 20 → h = 5 (30 hosts). 7 subnets needed.
Step 2: 2^3 = 8 ≥ 7 → borrow 3 bits. Mask = 32−5 = /27.
Step 3: block size = 2^5 = 32.
Subnet 1: 10.0.0.0/27 (hosts .1–.30, bcast .31)
Subnet 2: 10.0.0.32/27 (hosts .33–.62, bcast .63)
Subnet 3: 10.0.0.64/27 (hosts .65–.94, bcast .95)
Subnet 4: 10.0.0.96/27 (hosts .97–.126,bcast .127)
Subnet 5: 10.0.1.0/27 (hosts .1–.30)
Subnet 6: 10.0.1.32/27 (hosts .33–.62)
Subnet 7: 10.0.1.64/27 (hosts .65–.94)
Switch# show ip interface brief Switch# show running-config interface vlan 10 Switch# ping 10.0.0.1 source vlan 10
500 hosts → h where 2^h − 2 ≥ 500 → h = 9 (510 hosts). Mask = 32 − 9 = /23 /23 dotted = 255.255.254.0
Mask /27 → block 32. Network = 192.168.10.0. Broadcast = 192.168.10.0 + 31 = 192.168.10.31. Usable range 192.168.10.1 – 192.168.10.30.
/29 → borrow 5 bits → 2^5 = 32 subnets, each holding 6 hosts (2^3−2). Valid count (32 ≥ 5) but only 6 hosts per subnet — too small for most VLANs. The admin over-subnetted. A /28 would give 6 usable hosts; a /27 gives 14 hosts — check host needs first.
VLSM = allocate subnets of different sizes from the same block. Fixed subnetting (one mask) wastes addresses. VLSM is the backbone of an efficient RFC 1918 plan and of route summarization.
Allocate largest subnet first, then carve the remainder. Order by decreasing block size — otherwise you create fragmentation holes your next subnet can't use.
Block 10.0.0.0/24 must serve:
1) 100 hosts → /25 (block 128) — 10.0.0.0/25 → usable .1–.126, bcast .127 2) 50 hosts → /26 (block 64) — 10.0.0.128/26 → .129–.190 3) 20 hosts → /27 (block 32) — 10.0.0.192/27 → .193–.222 Remainder from .224 is two /29s (block 8): 4) P2P (2 h) → /30 (block 4) — 10.0.0.224/30 → .225–.226 remaining .228–.255 = six /30s available for future P2Ps loopbacks: use /32s from the tail: 10.0.0.253 - 255
Route summarization collapses many subnets into one shorter prefix. Rule: the block must align on a power‑of‑two boundary matching the summary.
Summarize 10.0.0.0/25, 10.0.0.128/26, 10.0.0.192/27 → 10.0.0.0/25 covers .0–.127 ❌ does NOT cover .128+ → Use 10.0.0.0/24 = whole block. Summary = 10.0.0.0/24.
Common mistake: summarizing 172.16.1.0/24 + 172.16.2.0/24 as 172.16.0.0/23 — valid only if 172.16.0.0/24 doesn't exist or is also summarized.
Router# show ip route
R 10.0.0.0/24 is subnetted, 4 subnets
10.0.0.0/25 is subnetted
10.0.0.128/26 is subnetted
S 10.0.0.0/24 [1/0] via 192.168.1.1 ← static summary
Router# show ip protocol
Routing Protocol is "ospf 1"
Area 0 Summary routes:
10.0.0.0/24 (summary network)
A: 120 hosts → /25 block 128 → 192.168.10.0/25 (.1–.126, bcast .127) B: 60 hosts → /26 block 64 → 192.168.10.128/26 (.129–.190, bcast .191) C: 28 hosts → /27 block 32 → 192.168.10.192/27 (.193–.222, bcast .223) Remainder 192.168.10.224/27 is free reserve / /30s.
Cover 8 subnets (/24) → need 3 borrowed bits → /21. Verify alignment: 10.4.8.0 is divisible by 8 in the third octet (8 = 0b1000) → aligned. Summary = 10.4.8.0/21 (covers .8.0–.15.255).
Summarizing reduces the OSPF LSDB and SPF domain: one inter-area (type‑3) LSA instead of three. Summarize at the ABR connecting this area to the backbone. The ABR advertises 172.16.0.0/22, hiding .0/.1/.2 specifics. The new .3 link is included in that same summary since 172.16.0.0/22 already spans .0–.3.
CIDR (Classless Inter‑Domain Routing) killed the rigid class system (A/B/C) in 1993. It lets you express any prefix length — e.g. /19 instead of just /8, /16, /24. Supernetting aggregates multiple smaller subnets into a single larger route, shrinking routing tables globally. Without CIDR, the Internet's BGP table would collapse under its own weight.
A CIDR block is network/length. Length = number of fixed bits (the mask).
10.0.0.0/8 → mask 255.0.0.0 (8 fixed + 24 host) 10.10.0.0/16 → mask 255.255.0.0 (16 fixed) 10.10.10.0/24 → mask 255.255.255.0 (24 fixed) 10.10.10.0/25 → mask 255.255.255.128 (25 fixed → 2 subnets of 126 hosts)
The shorter the prefix (smaller /N), the more hosts AND the broader the route — a /8 covers 16M hosts, a /30 covers only 2.
Supernetting = combine contiguous subnets into one shorter summary route. The summary must start on a binary boundary matching the aggregate block size.
Rule: the first address of the summary must be a multiple of the block size.
Four /24s from .0 through .3 → summary is 192.168.0.0/22. Verify alignment: block size = 2^(24−22) = 4 → 0 is divisible by 4 → aligned.
ISP advertises customer prefixes: 203.0.113.0/25, 203.0.113.128/26, 203.0.114.0/24.
1) 203.0.113.0/25 (covers .0 – .127)
2) 203.0.113.128/26 (covers .128 – .191)
3) 203.0.114.0/24 (covers .0 – .255 in 114 octet)
Combine 1+2 = 203.0.113.0/24 already perfect (covers .0–.255).
Now 203.0.113.0/24 + 203.0.114.0/24 → 203.0.112.0/22? No — 113 decimal: 0x71 → odd. Block size 2 → must start at even.
Better: 203.0.112.0/20 (16 subnets) would cover .112–.127 — too broad (leakage).
Correct: no tighter summary than /22? Let's check: 112/24 binary → 0x70 → even. 112+0 = 0x70, 112+1 = 0x71, 112+2 = 0x72, 112+3 = 0x73 = .115.
Does NOT cover 113/24 and 114/24? Actually .113/24 = 0x71, .114 = 0x72. Block size 4 with start 112 = 112, .113, .114, .115 → YES 203.0.112.0/22 covers .112–.115.
But we only have .113 & .114, not .112 & .115 — potential leakage. In BGP use aggregate-address 203.0.112.0 255.255.252.0 summary-only — accept leakage, it's still a valid route.
Symptom: Traffic to a newly‑added subnet gets blackholed.
Root cause: The upstream router's summary 10.0.0.0/13 already covers the new subnet 10.6.0.0/16, but your edge router has no more‑specific route pointing to the new location.
Fix: Ensure the edge router advertises 10.6.0.0/16 explicitly BEFORE the summary route takes effect, or use BGP unsuppress‑map to leak the new /16 through the summary filter.
172.16.0.0/22. Block size = 4. Starting address 172.16.0.0 is divisible by 4 in the 3rd octet → aligned. Covers .0.0–.3.255.
Yes. Block size = 2. Starting address 192.0.2.0 aligns on an even boundary (192.0.2.0 / 192.0.3.0). The /23 covers both.
Yes — the /16 covers both, so even after the /24 fails, the /16 remains in the table and traffic is forwarded (blackholed). Fix: use BGP conditional advertisements or unsuppress‑map to withdraw the /16 when none of the constituent /24s exist, or avoid summarization entirely when specific routes are critical.
IPv4 exhaustion is real — the last /8 blocks were allocated years ago. IPv6 gives 3.4 × 1038 addresses, enough for every atom on Earth. But IPv6 is not just "more addresses" — it changes how hosts configure themselves (SLAAC vs DHCP), how addresses are formed (EUI-64), and how neighbors are found (NDP replaces ARP). Every modern network has IPv6 traffic whether you plan it or not: Android and iOS prefer IPv6 when it exists.
Written as 8 groups of 4 hex digits, separated by colons:
2001:0db8:85a3:0000:0000:8a2e:0370:7334 Rules: 1. Leading zeros per hextet can be dropped → 0db8 → db8 2. One (and only one) double-colon :: compresses consecutive zero hextets 2001:0db8:85a3:0000:0000:8a2e:0370:7334 → 2001:db8:85a3::8a2e:370:7334 3. :: must appear only once — otherwise the address is ambiguous.
| Type | Prefix | Purpose / notes |
|---|---|---|
| Global unicast (GUA) | 2000::/3 | Routable on the Internet. Assigned by ISP/RIR. |
| Link-local | fe80::/10 | Automatically generated on every interface. Never routed. Used for neighbor discovery, OSPFv3, default gateway. |
| Unique local (ULA) | fc00::/7 | IPv6's answer to RFC 1918 — private, not routable on the Internet. |
| Multicast | ff00::/8 | Replaces IPv4 broadcast. No broadcast in IPv6. |
| Loopback | ::1/128 | Equivalent to 127.0.0.1. |
| Unspecified | ::/128 | Used as source during Duplicate Address Detection. |
Algorithm: split the 48-bit MAC in half, insert fffe in the middle, flip the U/L bit (7th bit of first octet) — the universal/local bit.
MAC: 00:1A:2B:3C:4D:5E Step 1: 001A:2B FF:FE 3C:4D:5E (insert FFFE) Step 2: flip U/L bit: 0x00 → 0x02 (bit 1 = 0→1) Result: 021A:2BFF:FE3C:4D5E → interface ID Full GUA: 2001:db8:1:10::21a:2bff:fe3c:4d5e/64
Host gets prefix from Router Advertisement (RA), builds interface ID itself, no DHCP needed:
DHCPv6 is optional (stateful) — RA can set M-flag ("get address from DHCPv6") or O-flag ("get other info like DNS from DHCPv6"). SLAAC itself does not provide DNS — you need RDNSS in the RA (RFC 8106) or DHCPv6.
! Enable IPv6 routing (needed for routing protocols, forwarding) Router(config)# ipv6 unicast-routing ! Static GUA on an interface Router(config)# interface gigabitethernet0/0 Router(config-if)# ipv6 address 2001:db8:1:10::1/64 Router(config-if)# ipv6 address fe80::1 link-local ! custom link-local Router(config-if)# no shutdown ! EUI-64 form — interface ID auto-derived from MAC Router(config-if)# ipv6 address 2001:db8:1:20::/64 eui-64 ! Default route via RA / gateway Router(config)# ipv6 route ::/0 2001:db8:1:1::1 ! Verification — ALWAYS use these Router# show ipv6 interface brief Router# show ipv6 route Router# ping ipv6 2001:db8:1:10::2 Router# show ipv6 neighbors
Healthy output sample:
Router# show ipv6 interface brief
GigabitEthernet0/0 [up/up]
FE80::1
2001:DB8:1:10::1
GigabitEthernet0/1 [up/up]
FE80::2
2001:DB8:1:20::21A:2BFF:FE3C:4D5E
Symptom: Hosts on the same VLAN can't ping each other or the gateway, yet routers see the interface up.
Root cause: IPv6 has no ARP. Neighbor Discovery (NDP) — ICMPv6 types 135/136 (NS/NA) — does the job. If a switch port has ICMPv6 filter applied, or NDP rate-limiting is too aggressive, neighbor discovery fails and the neighbor cache stays empty.
Fix:
! On the switch — never block ICMPv6; permit NDP explicitly Switch(config)# ipv6 access-list PERMIT-NDP Switch(config-ipv6-acl)# permit icmp any any nd-na Switch(config-ipv6-acl)# permit icmp any any nd-ns Switch(config-ipv6-acl)# permit ipv6 any any ! Router-side check Router# show ipv6 neighbors Interface Age Link-layer Addr State Gi0/0 5 001a.2b3c.4d5e STALE Router# debug ipv6 icmp
00:11:22:33:44:55. What EUI-64 interface ID does it produce, and which bit changes?Insert fffe: 0211:22ff:fe33:4455. The U/L bit (bit 1 of first octet, 0x00 → 0x02) flips to mark the address as locally unique. If the U/L bit were not flipped, the address would claim universal uniqueness.
Link-local (fe80::/10). The RA's source address is the router's link-local address, so the host installs the default route toward fe80:: — no global address needed. OSPFv3 also peers over link-local.
1) RDNSS option in the RA (RFC 8106) — stateless, no DHCP. 2) Stateful DHCPv6 (M or O flag set) which delivers DNS. Without either, SLAAC hosts have addresses but no name resolution.
Ethernet is the dominant LAN technology (IEEE 802.3). It solves one problem: how do many devices share a local wire and reliably deliver data to the right receiver? It does this with three mechanisms:
Why it matters in real networks: the vast majority of wired access ports, switch uplinks, and data-center fabric links run Ethernet. If you cannot read a frame and interpret a MAC address, you cannot troubleshoot switching, STP, or ARP — the layers built on top of it.
Standard Ethernet II frame (IEEE 802.3), minimum 64 bytes, maximum 1518 bytes (without preamble/SFD):
| Field | Size | Purpose |
|---|---|---|
| Preamble | 7 bytes | Synchronization (not part of frame) |
| SFD | 1 byte | Start Frame Delimiter (not part of frame) |
| Destination MAC | 6 bytes | Receiver address |
| Source MAC | 6 bytes | Sender address |
| EtherType | 2 bytes | Payload protocol (0x0800 = IPv4, 0x0806 = ARP, 0x86DD = IPv6) |
| Payload | 46–1500 bytes | Upper-layer data (IP packet) |
| FCS | 4 bytes | CRC-32 error detection |
Minimum frame size 64 bytes exists so a sender is still transmitting when a collision is detected — required for CSMA/CD to work on legacy shared media. Modern full-duplex links keep the same size for compatibility.
MAC = 48 bits, written as 6 hex octets. Each hex digit = 4 bits, so two hex digits = 1 byte.
Example: 00:1A:2B:3C:4D:5E
Calculation step by step:
2^10 = 1,024
2^20 = 1,048,576
2^30 = 1,073,741,824
2^40 = 1,099,511,627,776
2^48 = 2^40 × 2^8
= 1,099,511,627,776 × 256
= 281,474,976,710,656 possible MAC addresses
Special bits in first octet:
01:00:5E:xx = IPv4 multicast, 33:33:xx = IPv6 multicast)FF:FF:FF:FF:FF:FF| Half-duplex | Full-duplex | |
|---|---|---|
| Transmit/receive | One direction at a time (shared medium, hub) | Both directions simultaneously (switch↔device point-to-point) |
| Collisions | Possible — CSMA/CD + backoff | Impossible — separate TX/RX pairs |
| Effective throughput on 100 Mbps | ≤ 100 Mbps total (shared) | 200 Mbps aggregate (100 each way) |
| Modern use | Legacy hubs only | Standard on all switched links |
Auto-negotiation (IEEE 802.3u) sets speed and duplex automatically. If it fails, both ends may pick the same speed but different duplex — that is a duplex mismatch.
| Cable | Category | Speed | Max length | Connector |
|---|---|---|---|---|
| Twisted pair | Cat5e | 1 Gbps | 100 m | RJ-45 |
| Twisted pair | Cat6 / Cat6a | 1–10 Gbps | 100 m (Cat6a: 10G to 100 m) | RJ-45 |
| Fiber multimode | OM3/OM4 | 10–100 Gbps | 100–550 m | LC (SFP/SFP+) |
| Fiber single-mode | OS1/OS2 | 10–400 Gbps | km+ (e.g. 10 km, 40 km) | LC (SFP/SFP+) |
Twisted pair: straight-through cable (T568A/B both ends) connects unlike devices (PC↔switch); crossover connects like devices (PC↔PC, switch↔switch) — though modern auto-MDIX handles this automatically. TIA/EIA-568 defines pinouts. Fiber beats copper for distance, EMI immunity, and speed.
Symptom: a link shows up but throughput crawls; interface counters show CRC errors, runts, and late collisions; intermittent timeouts on the PC.
Typical cause: one side hard-coded duplex full, other side left on auto-negotiation (fails to negotiate → falls back to half-duplex). The full-duplex side sends while the half-duplex side is transmitting → late collisions, retransmits, severe slowdown.
Fix:
! Check both ends first show interfaces GigabitEthernet0/1 ! Set both ends identically — either both auto, or both hard-coded: interface GigabitEthernet0/1 speed 100 duplex full
Rule: never hard-code one end only. Hard-code both ends or leave both on auto. On modern 1G/10G links, always use auto-negotiation — it also negotiates flow control and master/slave clocking.
Configure speed/duplex on a Cisco IOS switch port:
Switch(config)# interface GigabitEthernet0/1 Switch(config-if)# speed 100 Switch(config-if)# duplex full Switch(config-if)# no shutdown Switch(config-if)# end
Verification:
Switch# show interfaces GigabitEthernet0/1
GigabitEthernet0/1 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 0050.7966.6800 (bia 0050.7966.6800)
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec
Full-duplex, 100Mb/s, media type is 10/100/1000BaseTX
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
5 minute input rate 12000 bits/sec, 10 packets/sec
5 minute output rate 18000 bits/sec, 15 packets/sec
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 output errors, 0 collisions, 0 interface resets
Healthy output = Full-duplex, expected speed, 0 CRC, 0 collisions. Any CRC/collision counter climbing = physical or duplex problem.
MAC address table check:
Switch# show mac address-table dynamic
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 0050.7966.6800 DYNAMIC Gi0/1
1 00e0.b4c1.2a10 DYNAMIC Gi0/2
48 bits = 6 bytes. Each octet is 8 bits; 6 octets × 8 = 48 bits.
Duplex mismatch. The full-duplex side transmits while the half-duplex side is transmitting → late collisions and CRC errors on the half-duplex side, interface resets on both. Fix: match configuration on both ends (both auto, or both hard-coded same speed/duplex).
First octet 0x01 → LSB = 1 → multicast (I/G bit set). 01:00:5E is the IPv4 multicast OUI range (EtherType 0x0800, IPv4 multicast traffic, e.g. OSPF 224.0.0.5/224.0.0.6, IGMP).
These three protocols are the nervous system of IP networking: ARP maps Layer-3 addresses to Layer-2 addresses, ICMP carries control/error messages, and ping/traceroute are the diagnostic tools built on ICMP. If you cannot read ARP and ICMP, you cannot troubleshoot anything beyond the interface level.
IP is a logical addressing scheme. Frames on Ethernet need a 48-bit MAC address to reach the destination NIC. ARP's job: given a known IP, find the MAC. Why: without ARP, every frame would have to be flooded like a broadcast, destroying switch efficiency.
FF:FF:FF:FF:FF:FF, asks "who has 10.0.0.2?"ICMP is the control-plane messaging protocol of IP. It never carries user data; it reports errors and provides diagnostics. ICMP lives inside IP packets (IP protocol number 1).
Host A Host B |----- Echo Request (Type 8, id=0x0001, seq=1, TTL=64) ----->| |<---- Echo Reply (Type 0, same id, same seq, TTL=64) -------|
ping sends one Echo Request per second by default, each with a fresh sequence number and an identifier (the process ID on Unix). Round-trip time = time between request and matching reply. Reply must echo the same identifier + sequence, or it is discarded (that's how you know a reply matches your ping, not another host's).
traceroute exploits the TTL field: each router that decrements TTL to 0 drops the packet and sends back ICMP Type 11 (Time Exceeded). By sending probes with TTL 1, then 2, then 3..., the source collects the address of every hop in the path.
traceroute: default UDP probes, 3 probes per TTL, 5s timeout* * * in output = no reply (device filtered probes or is silent) — not necessarily a dead linkHost A: 192.168.1.10/24 MAC aa:aa:aa:aa:aa:01 Router: 192.168.1.1/24 (LAN), 10.0.0.1/30 (WAN) Host B: 10.0.0.2/30 MAC bb:bb:bb:bb:bb:02
Step 1 — Host A pings 10.0.0.2. Destination is NOT on the local subnet (different network), so Host A needs the MAC of the gateway 192.168.1.1.
Host A sends ARP request: "who has 192.168.1.1?" (broadcast) Router replies: "192.168.1.1 is at cc:cc:cc:cc:cc:01" (unicast) Host A caches entry, TTL 4h.
Step 2 — Host A builds the Echo Request. IP header TTL=64. Frame: dst MAC = router MAC, src MAC = Host A MAC, payload = ICMP Type 8.
Step 3 — Router receives frame, strips L2, decrements TTL to 63, checks destination 10.0.0.2 — directly connected. Needs B's MAC: sends ARP "who has 10.0.0.2?" on the WAN segment, gets bb:bb:bb:bb:bb:02, re-encapsulates frame (new dst/src MAC), forwards.
Step 4 — Host B receives, replies Echo Reply with TTL=64. The reply traverses the same path back. Round-trip = 4 frame hops total.
Key calculation — TTL decrement: each router subtracts 1. A ping from Host A to Host B crosses 1 router → TTL seen at B = 64 − 1 = 63. If B's reply shows TTL 63, the path had exactly one router hop. You can estimate hop count from received TTL: 255 → ≤1 hop from Cisco gear, 128 → ≤1 hop from Windows, 64 → ≤1 hop from Linux.
Host A -- R1 -- R2 -- Host B traceroute 10.0.0.2 probe TTL=1 → R1 drops, sends ICMP Type 11 → source records R1's address probe TTL=2 → R2 drops, sends ICMP Type 11 → source records R2's address probe TTL=3 → reaches Host B, answers ICMP Type 3 Code 3 (UDP mode) → trace ends
Each TTL level gets 3 probes; output shows RTT per probe. Hops = number of lines in the trace = 2 routers + 1 destination.
! View the ARP table Router# show ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 10.0.0.1 - cc:cc:cc:cc:cc:01 ARPA GigabitEthernet0/0 Internet 10.0.0.2 2 bb:bb:bb:bb:bb:02 ARPA GigabitEthernet0/0 ! Clear stale ARP entries (first thing to try on "ping works to IP, fails to MAC" issues) Router# clear arp-cache ! ping with extended options Router# ping 10.0.0.2 repeat 100 timeout 1 Type escape sequence to abort. Sending 100, 100-byte ICMP Echos to 10.0.0.2, timeout is 1 seconds: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Success rate is 100 percent (100/100), round-trip min/avg/max = 1/2/4 ms ! traceroute Router# traceroute 10.0.0.2 Type escape sequence to abort. Tracing the route to 10.0.0.2 1 10.0.0.1 1 msec 1 msec 1 msec 2 10.0.0.2 1 msec 2 msec 1 msec
The ! in ping output = successful reply; . = timeout; U = destination unreachable; Q = source quench.
Symptom: ping to a remote server succeeds, but traceroute shows * * * at the first or second hop, and the trace never completes cleanly. Fix: intermediate routers often rate-limit or filter ICMP Type 11 (and some filter all ICMP), so they silently drop expired probes. The path is fine — the router just refuses to report. Verify with a ping to the final destination (if it succeeds, the path works) and treat * * * as "device silent", not "link dead". On Cisco, increase the probe count or switch to ICMP mode: traceroute 10.0.0.2 probe 5 or traceroute 10.0.0.2 icmp.
ICMP Type 11, Time Exceeded (Code 0). Traceroute manipulates the TTL field, starting at 1 and incrementing by 1 per probe round.
ARP request for 10.0.0.2 sent as broadcast (dst MAC FF:FF:FF:FF:FF:FF); Host B answers with ARP reply, unicast to Host A. Only after the reply populates Host A's ARP cache can Host A build the Echo Request frame with B's MAC. Same exchange occurs in reverse for the reply.
Reply left the server with TTL=64 and lost 2 decrements before reaching you → exactly 2 routers crossed in the return direction. With a symmetric path, the forward path also crosses 2 routers (server sees your probes at TTL 62). 64 − 62 = 2 hops.
The switch is the Ethernet forwarding engine. Unlike a hub (which repeats every frame out every port) or a router (which forwards by IP), a switch forwards frames by destination MAC address, using a hardware table called the CAM table. Why this matters: it gives you wire-speed, isolated, full-duplex forwarding between ports — but only if the table is populated and correct. Every switching exam question and every real-world "slow network" mystery comes back to CAM, learning, and flooding.
When a frame arrives on a switch port, the switch runs exactly three checks, in order:
This is called store-and-forward behavior at the table level: the switch never needs to know the full path, only "which port owns this MAC right now".
show mac address-table prints.
Host A (MAC aa:aa:aa:aa:aa:01) -- Gi0/1 -- [SW1] -- Gi0/2 -- Host B (MAC bb:bb:bb:bb:bb:02)
1. A sends frame to B. SW1:
- LEARN: aa:aa:aa:aa:aa:01 on Gi0/1 → CAM: {aa:...:01 → Gi0/1, VLAN 10}
- LOOKUP dst bb:bb:bb:bb:bb:02 → not found
- ACTION: flood out Gi0/2 (and any other access ports in VLAN 10)
2. B replies. SW1:
- LEARN: bb:bb:bb:bb:bb:02 on Gi0/2 → CAM: {aa:...:01 → Gi0/1, bb:...:02 → Gi0/2}
- LOOKUP dst aa:aa:aa:aa:aa:01 → FOUND on Gi0/1
- ACTION: forward unicast out Gi0/1 only — no flooding.
3. Every later frame A↔B: both entries present → pure unicast, wire-speed.
First frame in each direction is flooded; the reply teaches the switch the reverse mapping. This is why ARP (which triggers the first frame) and CAM learning are tightly coupled — your ARP cache and CAM table fill up together.
show mac address-table aging-time, show mac address-table count.
! Show the full table
SW1# show mac address-table
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
10 aaaa.aaaa.aa01 DYNAMIC Gi0/1
10 bbbb.bbbb.bb02 DYNAMIC Gi0/2
10 0100.0ccc.cccc STATIC CPU (STP BPDUs, CDP, VTP)
Total Mac Addresses for this criterion: 3
! Look for ONE MAC (e.g. the server on Gi0/24)
SW1# show mac address-table address 0050.7966.6800
! Find which port a MAC is on — the #1 troubleshooting command
SW1# show mac address-table | include 0050.7966
! Per-interface learned MACs
SW1# show mac address-table interface gigabitethernet 0/24
! Table statistics
SW1# show mac address-table count
! Static entry (example: pin server MAC to port)
SW1(config)# mac address-table static 0050.7966.6800 vlan 10 interface gi0/24
! Change aging time (global)
SW1(config)# mac address-table aging-time 600
Healthy output pattern: DYNAMIC entries on access ports, STATIC entries pointing at CPU (protocol MACs), no unexpected MACs on trunk ports, counts well under platform limit.
Symptom: client-to-server traffic fast, but server responses crawl. You check the server NIC — fine. You check CPU — fine. Then show mac address-table shows the server MAC flapping between Gi0/24 and Gi0/5, or worse, the server MAC is missing entirely while a switch with a full CAM has stolen its entries.
Root causes, in order of likelihood:
show etherchannel summary.show spanning-tree root placement.The fastest triage: show mac address-table count (is the table full?) + show mac address-table address <server-MAC> (is it learned, and on which port?). Two commands answer 90% of L2 forwarding problems.
Broadcast storms, ARP floods, and unknown-unicast flooding scale horribly. In a flat 2000-host VLAN, one ARP request reaches 1999 hosts. Design rules: keep VLANs sized sensibly (RFC 1918 + /24 per VLAN is a common norm), enable port security and storm-control on access ports, and use IGMP snooping for multicast. On NX-OS, the same concepts exist but the CLI differs slightly (show mac address-table works; TCAM usage is show system internal tcam on some platforms).
| Event | CAM action | Forwarding |
|---|---|---|
| Frame with known dst MAC | Refresh src entry | Unicast out one port |
| Frame with unknown dst MAC | Learn src | Flood VLAN |
| Broadcast dst FF:FF:FF:FF:FF:FF | Learn src | Flood VLAN |
| Multicast dst 01:00:5E:xx | Learn src | Flood unless IGMP snooping |
| Frame from unknown src MAC | Learn src | Then lookup dst as above |
It floods the frame out ALL ports in the same VLAN except the ingress port — because the destination is unknown (unknown unicast flooding). It also learns the source MAC and its ingress port.
After B's reply the table holds both A's MAC (learned from the first frame, port X) and B's MAC (learned from the reply, port Y). The reply went directly to A because by then the switch had A's entry from step 1 — so it forwarded unicast to A's port, no flooding.
Client request reaches server fine only if the client's MAC was learned before the table filled; the server's reply is unknown-unicast → flooded to all 199 other ports → server receives its own flooded frames (duplicate MAC on many ports), performance collapses, and the server MAC flaps or never appears in CAM. Commands: show mac address-table count (table full?) and show mac address-table address <server-MAC> (is it learned, on which port).
Flat L2 network = one broadcast domain. Every broadcast (ARP, DHCP, unknown unicast flood) reaches every host. Problems: wasted bandwidth, weak isolation, hard to move users between buildings/security zones.
VLAN (Virtual LAN) = logical partition of a switch, each VLAN is its own broadcast domain. Traffic in VLAN 10 never crosses into VLAN 20 unless routed (L3 = inter-VLAN routing, later lesson). Benefits: security (segment finance vs guests), smaller failure domains, flexibility — user location no longer tied to logical grouping.
Two switches need to know which VLAN a frame belongs to. Trunk port inserts a 4-byte tag after the Source MAC:
12 bits → 2^12 = 4096 possible IDs (0–4095). Usable: 1–1005 (normal), 1006–4094 (extended). Reserved: 0 (priority frames), 4095 (unused), 1 = default/native.
Switch recalculates FCS after inserting tag — frame is not forwarded with a stale checksum.
Trunk frames for the native VLAN are sent untagged (default native = VLAN 1). Both ends must agree on native VLAN. CDP/management/STP BPDUs typically ride VLAN 1 untagged.
Pitfall: native VLAN mismatch — switch A native 1, switch B native 10. Frames mislabeled → traffic leaks between VLANs or dies silently. Symptom: show interfaces trunk shows "native vlan mismatch" on one side; inter-switch hosts unreachable but ports stay up. Fix: set matching native VLAN on both ends, ideally an unused VLAN for security.
! create VLANs vlan 10 name SALES vlan 20 name GUEST ! access port — carries ONE untagged VLAN interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 ! trunk port — carries MANY tagged VLANs interface GigabitEthernet0/24 switchport mode trunk switchport trunk native vlan 99 switchport trunk allowed vlan 10,20,99
Tagged trunk default: all VLANs allowed. Narrow with switchport trunk allowed vlan for security and to stop unknown-VLAN floods crossing the trunk.
SW1# show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi0/1 10 SALES active Gi0/2, Gi0/3 20 GUEST active Gi0/4 99 NATIVE active SW1# show interfaces trunk Port Mode Encapsulation Status Native vlan Gi0/24 on 802.1q trunking 99 Port Vlans allowed on trunk Gi0/24 10,20,99 Port Vlans allowed and active in management domain Gi0/24 10,20,99
Healthy output signs: port Status = trunking, allowed list matches design, native VLAN matches on both ends. Wrong encapsulation on Cisco legacy ISL gear shows "encapsulation isl" — ISL is obsolete, use 802.1q.
Office moved switches. Two access switches cabled together, users in VLAN 10 on each side. PCs see each other's ARP but no ping works, show interfaces trunk on one side: Port Vlans allowed on trunk empty. Root cause: switchport trunk allowed vlan left over from old design allowing only VLAN 20. Fix: switchport trunk allowed vlan add 10. Verify: show interfaces trunk then ping across.
4094 usable (1–4094). Reserved: 0 and 4095. 12-bit VID → 2^12 = 4096 total, minus 2 reserved.
1522 bytes. The 4-byte tag (TPID + TCI) is inserted after the Source MAC, and FCS is recalculated over the new content.
B sends VLAN 10 frames untagged (its native). A reads untagged frames as VLAN 1 and floods them into VLAN 1, not VLAN 10 — traffic leaks into the wrong VLAN or drops. Symptom: native VLAN mismatch line in show interfaces trunk, hosts unreachable, ports stay up. Fix: match native VLAN on both ends (use an unused VLAN).