1 00:00:19,940 --> 00:00:25,280 In question 5 we're told to assume that switch 1s MAC address is empty. 2 00:00:25,870 --> 00:00:37,090 We can verify that by looking at the output of the show MAC address table command on the switch, as we 3 00:00:37,090 --> 00:00:39,500 can see here the MAC address table is empty. 4 00:00:40,400 --> 00:00:48,310 We're asked when PC 5 pings PC 8 what type of packet is sent to the switch initially 5 00:00:48,580 --> 00:00:50,100 and can we prove it? 6 00:00:50,380 --> 00:00:50,950 So 7 00:00:53,620 --> 00:01:01,000 IP config on PC 5 shows us the IP address of PC 5, 10 115 8 00:01:01,270 --> 00:01:02,150 PC 8 9 00:01:04,720 --> 00:01:08,630 has IP address 10 118. 10 00:01:08,690 --> 00:01:15,430 So what kind of frame or what kind of packet is sent to the switch when using terms such as frames and 11 00:01:15,430 --> 00:01:25,070 packets once again, are we referring to layer 2 or layer 3 or layer 4 of the OSI model. 12 00:01:25,090 --> 00:01:32,720 So what I'll do on PC 5 is ping 10 118 before I do that, 13 00:01:32,750 --> 00:01:35,960 notice the ARP cache is empty. 14 00:01:35,960 --> 00:01:41,880 On PC 5 if it had just a rebooted the ARP cache would be empty. 15 00:01:41,920 --> 00:01:49,580 So I'm gonna send two pings into the network we can see that the first packet that was generated is 16 00:01:49,580 --> 00:01:59,780 an ARP packet looking at the actual packet or frame we can see that at layer 2 the frame has a destination 17 00:01:59,780 --> 00:02:01,100 address of a broadcast. 18 00:02:02,130 --> 00:02:10,530 The type of packet at layer 3 is ARP, so in the layer 3 headers we can see that this is an ARP packet 19 00:02:11,460 --> 00:02:23,840 requesting the MAC address of host with IP address 10 118 so the Ethernet type is 06 08 06. 20 00:02:23,860 --> 00:02:28,280 In other words it's an ARP packet, capture forward 21 00:02:31,200 --> 00:02:43,360 and before I continue the answer to Question 5, is this is an ARP packet it's a broadcast packet we can 22 00:02:43,360 --> 00:02:51,100 see that again by looking at the inbound PDU on the switch notice destination address is a broadcast 23 00:02:52,190 --> 00:03:00,170 who receives the packet because it's a broadcast it's gonna be flooded to the other devices in the 24 00:03:00,170 --> 00:03:09,970 network and then PC 6 and PC 7 are gonna drop it because the packet is not destined to them. 25 00:03:09,970 --> 00:03:12,650 So the answer for question 6 is 26 00:03:12,700 --> 00:03:20,860 PC 6, PC 7 and PC 8 will receive the packet. 27 00:03:20,970 --> 00:03:22,400 Now here's where things change, 28 00:03:22,410 --> 00:03:26,140 who receives the return packet? 29 00:03:26,160 --> 00:03:33,450 So here we've got our ARP reply on the inbound PDU to the switch. 30 00:03:33,450 --> 00:03:37,290 We can see that the target mac address is this, 31 00:03:37,440 --> 00:03:43,330 that's the MAC address of PC 5. 32 00:03:43,420 --> 00:03:48,290 So the MAC address is actually written into the frame. 33 00:03:48,310 --> 00:03:54,120 This is a uni cost packet sent from PC 8 to PC 5. 34 00:03:54,220 --> 00:03:59,790 It's not a broadcast unlike the ARP request so notice what happens now. 35 00:04:01,930 --> 00:04:05,790 The packet is only sent to PC 5 36 00:04:05,860 --> 00:04:16,959 it's not flooded out of all ports so the only PC that receives it is PC 5 that is different to 37 00:04:16,959 --> 00:04:27,460 our previous example where PC 1, PC 2 and PC 3 received the return traffic and notice the difference 38 00:04:27,520 --> 00:04:34,320 in question 8 when ping traffic is sent from PC 5 to PC 8 who receives it. 39 00:04:34,450 --> 00:04:35,160 So here's our 40 00:04:37,720 --> 00:04:51,790 ICMP request or echo request message we can see that its ICMP destination MAC address is PC 8, 41 00:04:51,870 --> 00:04:56,040 source MAC address is PC 5 source IP address is 42 00:04:56,040 --> 00:05:00,150 PC 5 destination IP address is PC 8. 43 00:05:00,250 --> 00:05:10,670 So notice now that the packet is only sent to PC 8, so that's very different to what we saw when we 44 00:05:10,670 --> 00:05:19,130 were using a hub, a switch is different to a hub in that it has a separate collision domain on every 45 00:05:19,130 --> 00:05:30,190 port so when packets are sent from PC 5 to PC 8 they are sent directly between the devices they don't 46 00:05:30,730 --> 00:05:34,270 get flooded to the other PCs in the network. 47 00:05:34,270 --> 00:05:44,080 That is very different to a hub so to prove that what I'll do is populate the ARP cache of PC 6. 48 00:05:44,660 --> 00:05:45,890 So I'll get it to ping 49 00:05:46,000 --> 00:05:56,730 PC 8 and I'll run this in real-time so if we look at to the ARP cache of PC 6 ARP cache is populated 50 00:06:01,860 --> 00:06:05,160 the same is true on PC 5. 51 00:06:05,410 --> 00:06:06,000 So both 52 00:06:06,000 --> 00:06:15,180 PC 5 and PC 6 know the MAC address of PC 8. I'll change this to simulation mode 53 00:06:16,410 --> 00:06:21,980 and I'll get both of these PCs to ping PC 8 54 00:06:27,060 --> 00:06:30,090 both of them are sending ICMP packets 55 00:06:30,090 --> 00:06:32,130 they both get sent to the switch. 56 00:06:33,980 --> 00:06:41,170 And notice the first one is sent to PC 8 and then the second one is sent to PC 8. 57 00:06:41,170 --> 00:06:52,490 We don't end up with a collision so the switch caches the packet and allows the communication and 58 00:06:52,490 --> 00:06:54,300 to show you this in a different way. 59 00:06:54,320 --> 00:07:00,380 What I'll do is get PC 5 to ping PC 8 60 00:07:02,900 --> 00:07:14,140 but get PC 6 to ping PC 7. So PC 5 is pinging PC8, PC 6 is pinging PC 61 00:07:14,190 --> 00:07:21,920 7, in this case, PC 6 needs to ARP for the MAC address of PC 7. 62 00:07:22,030 --> 00:07:29,960 Notice however that there is no collision taking place. 63 00:07:30,090 --> 00:07:41,520 So now notice the ARP cache of PC 6 is populated with the MAC address of both PC 7 and PC 8. So I'll 64 00:07:41,520 --> 00:07:42,750 run that again 65 00:07:46,310 --> 00:07:49,370 and I need to be in simulation mode to do that. 66 00:07:51,830 --> 00:07:54,770 So they're both are sending ICMP packets 67 00:07:57,520 --> 00:07:59,300 these are unicast 68 00:07:59,340 --> 00:08:09,780 they are not broadcasts, notice the destination of this frame is PC 7 destination of this frame 69 00:08:10,650 --> 00:08:22,860 is PC 8 both packets can be sent and received by the switch without interference from the other conversation 70 00:08:25,000 --> 00:08:34,590 so the PCs can communicate now without collisions and they are essentially separated from the other 71 00:08:34,590 --> 00:08:42,900 conversation. The conversation between PC 5 and PC 8 happens independently of the conversation between 72 00:08:42,900 --> 00:08:45,900 PC 7 and PC 6. 73 00:08:45,930 --> 00:08:49,610 We have 4 collision domains here 74 00:08:53,840 --> 00:09:04,350 a hub is a single collision domain, a switch has a collision domain per interface, but again if PC 5 75 00:09:04,440 --> 00:09:05,730 sent a broadcast 76 00:09:09,950 --> 00:09:11,120 the broadcast 77 00:09:14,540 --> 00:09:20,240 would be forwarded to all devices in the network. 78 00:09:20,240 --> 00:09:21,770 This is a layer 2 switch 79 00:09:21,770 --> 00:09:29,810 it's gonna flood that broadcast out of all ports so everyone is gonna receive the broadcast and 80 00:09:29,870 --> 00:09:35,090 everyone is gonna have to reply back to that broadcast. 81 00:09:39,460 --> 00:09:46,220 Packet tracer is not perfect software but it allows you to visually see how traffic flows in the network 82 00:09:46,700 --> 00:09:53,480 and to learn how to answer questions such as these. 83 00:09:53,570 --> 00:10:01,550 So when studying for the CCNA exam you can use packet tracer to learn how traffic flows to learn what 84 00:10:01,550 --> 00:10:08,090 frames look like, what packets look like, what segments look like and it helps you essentially become 85 00:10:08,150 --> 00:10:10,430 a better network engineer. 86 00:10:10,490 --> 00:10:12,890 So were you able to answer these questions? 87 00:10:13,130 --> 00:10:20,360 Do you understand how data flows in a network when you have a switch or when you have a hub? 88 00:10:20,600 --> 00:10:24,920 Make sure that you understand how data flows through networks.