We help IT Professionals succeed at work.

Hosts MAC address Replication between  Switches

Hosts MAC address Replication between  Switches

I would like to know for  instance if I check the Mac address table of all 4 Switches in the topology above , may I find the mac address of PC1 and PC2, or do I need to generate traffic , ex: ping from PC to PC ? OR the mac address of both PCs can exist only on the Switches they are directly connected to ?

Thank you
Watch Question

Sr. Network Engineer
MAC addresses will be populated to each switch's individual CAM, pointing to the interface where it sees the MAC address originate from.

If you ping from PC1 to PC2 the process would look like the following:

(Assume the following for the sake of example:  1.  PCs are connected to port 10 or their respective switches.  2.  All ports on any switch are numbered based on the far switch it connects to - e.g. on switch 1, port 2 connects to switch 2, port 3 connects to switch 3.  3.  Port 2 on switch 1 and port 1 on switch 2 are in STP blocking state)

So, here goes.
1.  PC 1 sends ping to PC 2
2.  PC 1 has no ARP record for PC 2 so ARP-Request broadcast is sent first.
3.  PC 1 ARP-Request is received by SW3 on port 10
4.  SW3 populates PC1 MAC to CAM pointing to port 10, has no MAC for PC2, floods ARP to all ports, except port 10
5.  SW1 receives PC-1 ARP-Request on port 3, populates CAM point to port 3, has no MAC, floods ARP all ports except port 3
6.  SW2 receives PC-1 ARP-Request on port 2 (port 1 is blocking so no ARP received on port 1), populates CAM point to port 2, has no MAC floods ARP all ports except port 2
7.  SW4 receives PC-1 ARP-Request on port 3, populates CAM point to port 3, has no MAC, floods ARP all ports except port 3
8.  PC2 receives PC-1 ARP-Request from SW4, port 10, populates ARP table
9.  PC2 responds to PC1 with unicast ARP-Response
10.  SW4 receives PC1 ARP-Response, port 10, populates CAM with PC1 MAC, pointing to port 10, forwards ARP out port 3 to SW3
11.  SW3 receives PC1 ARP-Response, port 3, populates CAM with PC1 MAC, pointing to port 3, forwards ARP out port 10 to PC2
12.  PC2 receives PC1 ARP-Response, populates ARP table with PC1 MAC
13.  ICMP ping traffic is sent, PC1 IP in packet header, PC1 MAC in frame header
14.  All further communications will be ARP lookup at originating host and traffic forwarded with table information until ARP record times out, then go back to 2

Notes -
All ARP requests are broadcasts
All ARP requests received by a switch will be flooded out all ports except port received on
All ARP replies are unicast and follow port to port path back through switches to request originator
All MAC addesses seen by a switch are populated to switch CAM pointing to port MAC received on
Switch CAM and Host ARP tables remain populated until timeout
nociSoftware Engineer
Distinguished Expert 2019
Sleight addendum:
If a switch has NO clue about where a MAC address hangs out (ie. it has never learned it) the switch will flood all interfaces with that request.
(Step 4) except for broadcasts, (any packet with yy-xx-xx-xx-xx-xx, where yy is odd, f.e. ff) then a packet is sent to all interfaces (except the originating interface).  - or you may note that even if a broadcast is used as source it will never populate the CAM tables.
So the CAM population even works with protocols not utilizing ARP or likewise techniques. (DECnet f.e. has no notion of broadcast anyway).
Also flooding is only done in interfaces WITHIN the same VLAN.

Microsoft Cluster depend heavily on this feature. ALL messages FROM a network cluster always use the private MAC address from the server, where all ARP replies have the Cluster Alias MAC address in the content.
(See https://en.wikipedia.org/wiki/Address_Resolution_Protocol for information on ARP, the reply fields are separate from the carrier fields).
This way an ethernet packet always gets to ALL clustermembers without the need to utilize "broadcast"... it is implicitely done by the switches. (If this would not be done like this, a switch would either send packets only in one direction, or if multiple machines respond with one MAC address you would get warnings about "flapping".


Assuming  there is no Ping between PC1 and PC2 initiated.

By just plugging PC1 and PC2  to their respective Switches will cause ARP request to  go to all other switches ?
nociSoftware Engineer
Distinguished Expert 2019

If your want to access an IP address there are two options:
1) it falls  within one of the connected networks (directly attached)   - Query address is IP address mentioned
2) it Doesn't then a route lookup is done where the netmask decrement until a match is found.
    (The ulitmate match is netmask 0 (implying ip address of network aka the default route.
    On match query address is set to the gateway address found.
Then the network technology is determined: Point-Point (tunnel) or Broadcast network.. (Ethernet, tokenbus, tokenring, radio).
In the PtP case the packet is handed to the transmitter... (what goes in one end will pop up on the other end, regardless).
In the case of Broadcast Address Resolution is needed:
Then first the ARP table is checked if the entry is KNOWN.. (Either static, or recent query).
If unknown then an ARP query is done to get the MAC address of the Query address.
The MAC address found is used by the transmitter as the target address for then network frame.

Arp table can be checked, manipulated with the arp utility.


EE for some reason gives just the option to select Best Solution. You cannot assign Assisted Solutions
nociSoftware Engineer
Distinguished Expert 2019

Maybe request help from a moderator. AFAIK after selecting the best optional should be selectable (before accepting) ..
Also assignment of points should selectable somewhere.


Thank you Guys!