MAC Address Learning and ARP Operation

In a local Ethernet network, data link communication relies on hardware 48-bit Media Access Control (MAC) addresses, while network layer communication relies on 32-bit Logical IPv4 addresses. For devices to communicate successfully, two fundamental mechanisms operate concurrently:

1. Layer 2 MAC Address Learning: Ethernet switches inspect the source MAC address of every incoming frame and record it in a Content Addressable Memory (CAM) or MAC address table alongside the incoming physical port.
2. Layer 3 Address Resolution Protocol (ARP): Hosts consult and populate their local ARP cache to map a known target IPv4 address to its corresponding physical MAC address before encapsulation.

In this laboratory exercise, you will investigate how a Cisco Catalyst switch dynamically builds and ages out its MAC address table, how host operating systems send ARP requests and replies, and how Layer 2 frame forwarding transitions from unknown unicast flooding to targeted unicast forwarding.

Learning Objectives#

• Explain how a Cisco Catalyst switch dynamically populates its MAC address table using incoming frame source MAC addresses.
• Contrast unknown unicast flooding with known unicast filtering and forwarding.
• Inspect, interpret, and clear the host ARP cache (arp -a and arp -d) on end devices.
• Trace the step-by-step interaction between host ARP resolution and switch MAC address learning during ping transactions.
• Examine MAC table aging and practice manually clearing dynamic entries using clear mac address-table dynamic.

Prerequisites#

• Basic familiarity with Cisco IOS command modes from PTL-0008: Cisco IOS Navigation and Initial Device Configuration.
• Understanding of IPv4 address formatting and subnet masks (255.255.255.0 / /24).
• Familiarity with the diagnostic methodology outlined in the Troubleshooting Guide.

Topology#

The topology connects three generic host PCs and one Cisco ISR 4321 router gateway through a single Cisco Catalyst 2960-24TT switch in broadcast domain 192.168.1.0/24:

• Switch S1: Central Layer 2 Catalyst 2960 switch maintaining the MAC address table.
• Workstations (PC-A, PC-B, PC-C): Connected to switch FastEthernet ports Fa0/1, Fa0/2, and Fa0/3.
• Router R1: Connected via switch port GigabitEthernet0/1 to provide gateway connectivity on 192.168.1.1.

Addressing Table#

Lab Tasks#

1. Verify Baseline State: Verify that S1 has an empty dynamic MAC address table and host PCs have empty ARP tables.
2. Observe ARP Broadcast and Resolution: From PC-A, ping PC-B (192.168.1.20) and observe ARP resolution in PC-A's ARP table.
3. Verify S1 Dynamic MAC Learning: Inspect the dynamic MAC address table on S1 to confirm port mappings for PC-A (Fa0/1) and PC-B (Fa0/2).
4. Resolve Default Gateway: From PC-A, ping router gateway R1 (192.168.1.1) and observe switch learning on port Gig0/1.
5. Populate Multi-Node CAM Table: Ping PC-A from PC-C (192.168.1.30) and verify all connected hosts appear in the switch MAC table.
6. Investigate Negative Resolution: Ping an unassigned IP (192.168.1.99) to observe ARP timeout behavior and absent cache entries.
7. Clear and Re-Learn Entries: Clear dynamic entries on S1 using clear mac address-table dynamic and verify dynamic re-learning upon subsequent traffic.

Configuration Walkthrough#

1. Router R1 Interface Configuration#

On Router R1, the local gateway interface is configured and enabled:

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# description Gateway for Local Subnet
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# end
R1# write memory

2. Switch S1 Initial Hostname Configuration#

On Switch S1, set the basic hostname:

Switch> enable
Switch# configure terminal
Switch(config)# hostname S1
S1(config)# end
S1# write memory

3. Workstation IP Configuration#

In the starter topology (assets/starter.pkt), verify or configure host network settings:

• PC-A: IP 192.168.1.10, Subnet Mask 255.255.255.0, Gateway 192.168.1.1
• PC-B: IP 192.168.1.20, Subnet Mask 255.255.255.0, Gateway 192.168.1.1
• PC-C: IP 192.168.1.30, Subnet Mask 255.255.255.0, Gateway 192.168.1.1

Verification#

Positive Test 1: Empty Initial State#

Before traffic is sent, verify that the host ARP cache and switch dynamic MAC table are empty:

PC-A> arp -a
No ARP Entries Found

S1# show mac address-table dynamic
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----

Positive Test 2: Intra-Subnet Ping (PC-A to PC-B)#

Ping PC-B (192.168.1.20) from PC-A:

PC-A> ping 192.168.1.20

Pinging 192.168.1.20 with 32 bytes of data:

Reply from 192.168.1.20: bytes=32 time<1ms TTL=128
Reply from 192.168.1.20: bytes=32 time<1ms TTL=128
Reply from 192.168.1.20: bytes=32 time<1ms TTL=128
Reply from 192.168.1.20: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.1.20:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

Positive Test 3: Inspect S1 MAC Address Table#

Inspect S1's dynamic table to observe learned MAC addresses:

S1# show mac address-table dynamic
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0001.c955.51bd    DYNAMIC     Fa0/1
   1    0001.c97d.8904    DYNAMIC     Fa0/2

Note: S1 learned PC-A's MAC on Fa0/1 from the ARP request frame, and PC-B's MAC on Fa0/2 from the ARP reply frame.

Positive Test 4: Inspect PC-A ARP Table#

PC-A> arp -a
  Internet Address      Physical Address      Type
  192.168.1.20          0001.c97d.8904        dynamic

Positive Test 5: Gateway Reachability and Uplink MAC Learning#

From PC-A, ping R1 gateway (192.168.1.1):

PC-A> ping 192.168.1.1

Pinging 192.168.1.1 with 32 bytes of data:

Reply from 192.168.1.1: bytes=32 time<1ms TTL=255
Reply from 192.168.1.1: bytes=32 time<1ms TTL=255
Reply from 192.168.1.1: bytes=32 time<1ms TTL=255
Reply from 192.168.1.1: bytes=32 time<1ms TTL=255

Ping statistics for 192.168.1.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

Verify S1 now includes R1 on uplink Gig0/1:

S1# show mac address-table dynamic
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0001.c7ea.b801    DYNAMIC     Gig0/1
   1    0001.c955.51bd    DYNAMIC     Fa0/1
   1    0001.c97d.8904    DYNAMIC     Fa0/2

Positive Test 6: Complete Multi-Host Population#

From PC-C, ping PC-A (192.168.1.10). Then verify that S1 has learned all four devices:

S1# show mac address-table dynamic
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0001.c7ea.b801    DYNAMIC     Gig0/1
   1    0001.c955.51bd    DYNAMIC     Fa0/1
   1    0001.c97d.8904    DYNAMIC     Fa0/2
   1    00e0.f740.df65    DYNAMIC     Fa0/3

Troubleshooting#

Key Takeaways#

• Source MAC Learning: A Layer 2 switch inspects the source MAC address of every incoming frame to learn which device connects to which physical port.
• Destination MAC Forwarding: When forwarding, the switch looks up the destination MAC address:
  • If the MAC is found in the CAM table, the frame is forwarded only out that specific port (known unicast filtering/forwarding).
  • If the MAC is not found, the switch floods the frame out all ports in the VLAN except the receiving port (unknown unicast flooding).
• ARP Resolution: Layer 3 hosts do not know MAC addresses inherently. Before sending an IPv4 packet, a host broadcasts an ARP Request (FF:FF:FF:FF:FF:FF). The owner responds with a unicast ARP Reply.
• Dynamic Aging: Dynamic MAC table entries age out after an inactivity timeout (default 300 seconds in Cisco IOS) to adapt to topology changes and device reconnections.
• Manual Maintenance: Network administrators can purge stale entries immediately using clear mac address-table dynamic.

References#

• Cisco Catalyst 2960 Switch Software Configuration Guide: Configuring MAC Address Tables
• RFC 826: An Ethernet Address Resolution Protocol (ARP)
• Repository Troubleshooting Guide

Files and Validation Status#