Switching basics

The best link in the world... Cisco's Internetworking Technology Handbook
http://www.cisco.com/univercd/cc/td/doc/cisintwk/ito_doc/index.ht

Also from Cisco - The Internetwork Troubleshooting Handbook.
http://www.cisco.com/univercd/cc/td/doc/cisintwk/itg_v1/index.htm

I found the troubleshooting handbook to be more usefull to me personally than the general handbook, but I am also a network tech for a living.

Wikipedia's "Network Switch" article:
http://en.wikipedia.org/wiki/Network_switch

And since we are talking about switching, its a good idea to know about Layer two:
http://en.wikipedia.org/wiki/Data_link_layer

Good luck, and I hope that helps!

My comments are based on a strict definition of a layer 2 switch.

>>Switches do broadcast (ARP) first time to learn the destination mac address

This is incorrect.  Switches do not ARP.

.Next time if any packet comes from the same source to same destination it'll not do broadcast,it'll look into the mac-table & send it to the destination directly (unicast).

>>if the destination is not availabl then it'll send it to the default-gateway.

Incorrect.  Switches do not have a default gateway - they do not operate at layer 3, the Network layer.

>>1. How will the switch know whether this packet has to send it to the default gateway or not?

They don't.  They only send to other devices on their local Ethernet segment - or VLAN.  They know nothing of layer 3.

>>2. Will Switch maintain the destination adress as the mac-address of default-gateway for all the hosts in different subnet.

No.  See previous answers on default gateways.

>>3.What will happen if we move the host from one switch to another switch (same subnet)within the MAX-age timer expires.

It depends on which direction the data flow is going.  If the two switches are connected the old may learn of the new location for the MAC and have two entries in its table for the same MAC.

A switch works basically like this:
A sends to B - switch learns of A and notes.  Floods to B (assuming it doesn't know of B)
B gets a flood packet and responds to A - switch learns of B and notes.
Thereafter, all traffic to and from A and B is switched only between the two ports.

An IP host on an IP network needs to send to a destination on a different IP network.  Using binary math and its subnet mask, it will determine it needs the default gateway.  The first time, it will ARP for the IP of the default gateway - which has to be on the SAME layer 2 Ethernet network.  The router will respond with its MAC address.  The host will address the frame with the destination MAC of the router and the source MAC of itself and then transmit onto the Ethernet network where it will be switched according to destination MAC address.

pseudocyber is 100% correct.  

The only thing I will add is is that some switches are called layer 3 switches.  This is really not switching this is routing (layer 3 or IP).  If a switch is a "layer 3 switch", it is really a switch and a router in one box.  The router part does know about layer 3, and thus IP, but the switching software does not.  

This is where some people get really confused because the network manufactures are making it look like you can switch IP, which you really can't, you switch layer 2 (Ethernet) and you route layer 3 (IP).  They are just putting the two functions into one box.  In some boxes you configure the layer 2 and layer 3 from the same configuration screen, like a Cisco 3550.  In others you actually have two independent managment interface that you configure in conjunction with each other, but seperately, like a Cisco 6500 with MSFC or a 7600 (a 7600 is really just a 6500 with the MSFC and PFC card installed by default).

First, You need to understand switching.  Switching is simply a process carried out using ASIC (Application Specific Integrated Circuits)  Routers and Bridges and switches are terms that are used interchangeably sometimes, but there are differences.  Routers operate at layer 3 and above and are aware of IP addresses.  A switch can do this also but it must be a Layer3 switch.  The primary difference in these two is speed.  ASIC technoology is much faster that software routing.  Layer 3 switches still use some software but the bulk of the work is carried out in ASIC hardware.  

Like wise Bridges and Layer 2 switches have the same relationship.  They operate at layer 2 and below and do not understand IP addresses.  Any Ip address assigned to a Layer-2 device is for accessing the management interface and has nothing to do with the actual operation of the device.

Layer 2 devices listen to traffic and remember the SENDER's MAC address and associates it with the physical port it recieved the packet on.  This allows the switch to remember where that computer is when it is time to send it a packet.  As mentioned in a previous comment, layer 2 devices do not ARP for addresses.  If they do not know which port to send the packet to, the device FLOODs the packet.  Flooding is different than broadcasting.  A broadcast is actually addressed to a MAC address of all FFFFFFFFFF.  Every device is obligated to pick up the packet and start processing it.  The device can decide to stop processing it once it realizes the packet does not apply to it, but It is required to pick it up.  Flooding is non-obligatory.  The packet is addressed to the same MAC address as when it entered the switch, the switch simply sends that packet to all ports..with out changing the MAC address to all FFFFFFF.  No device will pick up the packet unless it has the packets destination MAC address.   Broadcast packets are always flooded but flooded packets are not necessarily broadcast packets.

If the destination MAC address does not respond, the Layer 2 device could care less.  It has done its job...It has released the packet on the correct wire.  It is up to the end station sending the packet to decide the other end station is not there.


QUESTION 1. How will the switch know whether this packet has to send it to the default gateway or not?  

The Layer 2 switch does not determine this.  Actually the sending station has already made this decision and addressed the packet and ARPed for the target devices MAC address and placed that MAC address in the Packet's destination MAC address slot and released it on the wire.  The switch just looks at that MAC address and releases it to the correct wire if it is known and if it is not known, the switch floods the packet.

QUESTION 2. Will Switch maintain the destination adress as the mac-address of default-gateway for all the hosts in different subnet.
No but the sending station will...because it is the device that actually requested the MAC.  However the Sending station will know that it is not Privy to the far station's MAC adress because it is on a remote subnet that will never see the ARP packet.  The sending PC determines this by comparing its IP with the REMOTE IP.  Once it decides it is on the remote subnet, the packet is addressed to the default gateway with a ROUTE ME flag set.  Effectively, the sending computer will remember the router's MAC as the MAC of all remote devices.

The switch does something similar though.  It sees all devices on an uplink port as being on a single wire.  So if you have a hub that has 10 PCs on it, and that hub is plugged into the switch, the switch will see all of the 10 PCs as being plugged into a single port.  By the way, a hub simply floods all of the time.  It is a glorified repeater...absolutely no intelligence.

QUESTION 3.What will happen if we move the host from one switch to another switch (same subnet)within the MAX-age timer expires.
This can cause temporary problems on the network.  Most switches are smart enough to see that the PC moved from port to port but when it moves from switch to switch the network might get temporarily confused.  That is why the addresses expire.  If you stack the switches, they are normally pretty good about telling each other about the changes, but if you just uplink, you could get in a situation where the relocated PC was lost for a minute or two.  This is unlikely though since the first packet to hit the new switch gets flooded so the old switch would see the packet on a different port and delete its old entry.

Also please point me to some good links which will explain in depth of switching technology.
I would go to Cisco.com They have hundreds of white papers on this stuff.

If you want some interesting reading, look up the terms "split horizon"  "poison reverse" or "count to infinity" on the Cisco site.

Other interesting things dealing with Layer-2 switches include Virtual LANs (VLAN) and VLAN Trunking Protocol (VTP)