I'd like you to imagine with me that a device on the network
is doing a ping just to verify basic connectivity
to some other device on the same network.
And let's imagine that it's this device right here, PC-1,
that's doing the pinging over to PC-4.
Also, as part of that ping request,
I have a little Wireshark packet analysis snippet
right here that we can look at as well.
Here it's showing us the layer 2 information with the source
MAC address and the destination MAC address,
which matches up with the MAC addresses of those devices.
And then the protocol behind the scenes
that's being used for a ping request
is ICMP, the Internet Control Message Protocol.
So here's my question for you.
If PC-1 crafted this ICMP echo request, which it did,
how did PC-1 know what the layer 2 address was
of PC-4 on that same network?
And two ideas come to mind.
Number one, it's just magic.
That's the way it works.
Or number two, it's using some type
of a protocol, a set of rules, that
allows it to discover and learn what the layer 2 address is
of PC-4.
And the latter of those two is true.
And the protocol we're going to use
that resolves, or determines, or figures out
what the layer 2 address is of another device
on the same network is called ARP.
It's Address Resolution Protocol.
And here's the basics of how ARP operates.
When PC-1 is getting ready to do a ping request, for example,
to the host at 10.100.0.4, it's true that PC-1 really is going
to need the layer 2 address of PC-4's network interface card
so it can put that destination layer 2 address in the frame
to send the ping request.
So in its preparation for sending that ping request,
it looks at its ARP cache.
Sometimes that's also referred to as an ARP table.
And in the ARP cache, PC-1 is going to look to see
if he's already learned the layer 2 address associated with
that host at 10.100.0.4.
In the event that the ARP cache is empty, or at least doesn't
have the layer 2 address for PC-4 here,
what PC-1 is going to do, it's going to send an ARP request.
And that ARP request is sent from PC-1
as a layer 2 broadcast.
It's like an all-points bulletin that everybody
is going to see who's currently connected to
and working in the same VLAN as PC-1.
In this case, it's VLAN 100.
And then that ARP request is going to say, hey,
I'm looking for the person who owns the IP address
of 10.100.0.4.
And if that's you, please reply back with your layer 2 address.
I need it so I can forward additional frames to you.
And the question I have for you regarding a layer 2
broadcast that's being sent into the switch, what does
a switch do with a layer 2 broadcast?
And we've touched on this at least once
in a previous Nugget.
And if you said, Keith, I got it.
It's going to forward that broadcast
to all other ports that are associated with that same VLAN.
In this case, it would be VLAN 100.
And that's absolutely accurate.
So if we follow that logic, the switch
would forward that broadcast out port
Gig 0/2 because that's part of VLAN 100.
It would take a quick moment and consider Gig 0/3
and say, oops, wrong VLAN.
It wouldn't send it out to PC-3.
So PC-3 wouldn't see it.
But the trunk is supporting VLAN 100,
and so the switch would tag it with an 802.1Q tag
and propagate that broadcast over the trunk link over
to switch 2 who would receive it.
And then switch 2 would continue to forward
that frame to any ports associated
with that same VLAN--
the VLAN 100.
In this case, we only have one.
So that frame would be forwarded out Gig 1/1.
So the three ports that are associated with VLAN 200, which
are access ports, they would not get
that broadcast sent to those devices
because they're not a member of VLAN 100.
So let's take a closer look at the ARP request,
and we'll go ahead and expand the details down below.
So in this ARP request at layer 2,
it's sourced from the layer 2 address, the physical address,
or MAC address-- whatever you want to refer to it as--
of PC-1.
And we can focus on those last four characters
as matching PC-1's MAC address.
And then for the destination address,
this is what a layer 2 broadcast looks like in hexadecimal.
It's all f's.
So we have 12 f's.
Each of those f's represents four bits that are on,
which is 48 bits all on.
And so when the switch sees that, it says,
oh, I know what that is.
And then it goes to work to forward that broadcast
to all other ports that are associated with that same VLAN.
And as we take a look at the details
regarding the ARP request itself,
here showing us the sender MAC address and the sender's IP
address, which the PC-1's address,
the layer 2 destination address is the broadcast.
And then it has the target IP address.
So even though every device that's in VLAN 100 will have
an opportunity to look at this ARP request,
only the device that owns and is currently using the IP address
of 10.100.0.4 will do a reply.
And if we take a look at the next packet right here,
this is the response coming back from PC-4 back to PC-1.
And once PC-1 gets that ARP reply,
it's so happy about that information
it's going to go ahead and cache PC-4's layer 2 address
inside of the ARP table, also referred to as an ARP cache.
And the intent there is, if we ever
have to send a frame over to PC-4 again,
I don't have to do the whole ARP request again.
I can just look at my ARP cache.
And if the information is there, I
can simply use it as I create new frames that are destined
or need to go to Mr. PC-4.
I hope this has been informative for you,
and I'd like to thank you for viewing.