One Monday at 8:30 a school called me in a panic: “the whole network is dead, the switch must have burned out.” The culprit was a two-meter patch cable that someone, meaning well, had plugged between two wall jacks “so it wouldn’t dangle.” That cable created a loop, the loop spawned a broadcast storm, and the storm took 800 students offline. To understand how two meters of copper can flatten an entire building — and why they almost never manage to — you have to open the switch and look inside. Spoiler: there’s no magic in there. There’s a table, some tags, and a tree.
How a switch learns (no magic involved)
Picture a building concierge on their first day, knowing nobody. Every time a resident hands over a letter to mail out, the concierge glances at the return address and jots down: “Mrs. Pérez lives in 402.” No questions, no guessing: they learn by watching where things come from. A switch does exactly that with every frame it receives: it reads the source MAC and notes in its table, “this MAC lives behind this port.”
When a frame arrives for a known destination, the switch forwards it out that one port only. And if the destination isn’t in the table? The concierge shouts across the lobby: the frame is flooded out every port except the one it came in on. Whoever answers gets learned, and the next delivery goes direct. Broadcasts (destination ff:ff:ff:ff:ff:ff) are always flooded, by definition. And since residents move out, table entries expire: the default aging timer is 300 seconds without seeing traffic from that MAC.
Vlan Mac Address Type Ports ---- ----------- ---- ----- 10 b4:96:91:1a:2f:03 DYNAMIC Gi1/0/07 10 f4:39:09:55:c0:11 DYNAMIC Gi1/0/12 20 00:11:32:8b:44:9e DYNAMIC Gi1/0/24 Total Mac Addresses for this criterion: 3
The frame: an envelope with 20 invisible bytes
The envelope traveling down the wire has a fixed layout: destination MAC (6 bytes), source MAC (6), EtherType (2, declaring what’s inside: IPv4, IPv6, ARP…), the payload (46 to 1500 bytes) and the FCS (a 4-byte checksum at the end). Legal minimum: 64 bytes. Classic maximum: 1518.
But the wire charges more than Wireshark shows you. Before every frame come 8 bytes of preamble + SFD (a clapperboard that syncs the clocks), and after it come 12 bytes of IFG, the mandatory silence between frames. That’s 20 bytes per frame no capture will ever display, yet they burn wire time all the same. With small frames, that tax hurts.
Those 20 bytes explain the most quoted — and least understood — number in switching: how many frames per second a link can carry. Let’s run it at 1 Gbps with minimum-size frames:
- The smallest legal frame is 64 bytes: 6 (destination) + 6 (source) + 2 (EtherType) + 46 (payload) + 4 (FCS).
- Add the invisible tax: 8 bytes of preamble+SFD and 12 of IFG. On the wire it occupies 64 + 20 = 84 bytes.
- Convert to bits: 84 × 8 = 672 bits per frame.
- Divide the line rate: 1,000,000,000 ÷ 672 = 1,488,095 frames/s ≈ 1.49 Mpps. That’s the theoretical ceiling of a gigabit port under small-frame traffic (think VoIP, or attacks).
- Sanity check: with 1518 B frames it’s 1,538 × 8 = 12,304 bits, i.e. just 81,274 pps. Same link, 18 times fewer packets — which is why firewalls are specced in pps, not just Gbps.
Want to play with other sizes and speeds without a spreadsheet? The Ethernet frame & PPS calculator runs exactly this math from 1G to 100G, with and without a VLAN tag.
VLAN 802.1Q: virtual walls inside the same box
A VLAN turns one physical switch into several logical ones: cameras on one side, guests on another, and neither sees the other’s broadcasts. The mechanism is almost embarrassingly simple: a 4-byte tag inserted inside the frame, between the source MAC and the EtherType (see the diagram above). Two bytes of TPID (0x8100, “heads up, this is tagged”) and two bytes carrying the PCP (3 priority bits, values 0 to 7), the DEI bit and the 12-bit VLAN ID: 4096 values, of which 4094 are usable (0 and 4095 are reserved).
Back to the building. An access port is an office door: everything coming out of it belongs to that office, so nobody wears a badge indoors — the switch pins the tag on when the envelope enters the hallway and peels it off on delivery. A trunk port is the shared mailroom corridor: envelopes from every office travel through it, each with its sticker on, because without stickers nobody could tell which office owns what. Access = one port, one VLAN, untagged. Trunk = many VLANs, all tagged.
The 3 PCP bits (802.1p) are the “fragile” stamp on the envelope: mark voice with priority 5 or 6 so the switch ships it out ahead of the Windows Update download. And when a service provider hauls your VLANs across its network, it uses Q-in-Q (802.1ad): it wraps your frame, tag and all, inside a tag of its own (the S-TAG, TPID 0x88a8). An envelope inside an envelope: you keep your 4094 VLANs untouched and the provider moves you around as a single customer. The maximum frame grows to 1522 B with one tag and 1526 B with two. You can dissect any tag bit by bit with the VLAN decoder and build the double tagging with the Q-in-Q tool.
STP: the tree that puts out the storm
Now, back to that school cable. Layer 2 has no TTL: a frame can circle forever. Connect two switches with two cables (or one wall jack to another) and every broadcast entering the ring gets forwarded, comes back, gets forwarded again… and since each switch floods it out every port, it doesn’t just loop — it multiplies. Within seconds the links saturate with copies of the same ARP — remember the ceiling: up to 1.49 million frames per second on every gigabit port — CPUs choke, and MAC tables go haywire watching the same source MAC arrive on two ports at once (MAC flapping). That’s a broadcast storm, and it doesn’t fix itself: it stops when the loop is cut.
Spanning Tree (STP/RSTP) cuts the loop for you, deliberately and with criteria. First the switches elect a root bridge: lowest bridge ID wins, which is the priority (0 to 61440 in steps of 4096, default 32768) followed by the MAC address. On a priority tie, the lowest MAC wins — which is usually the oldest switch in the closet, not the best one. Then every switch computes its cheapest path to the root by adding up each link’s cost, keeps that port as its root port, and every redundant link ends up with one blocked port: still there, still listening to BPDUs, ready to take over if the main path dies.
| Speed | Short cost (802.1D-1998) | Long cost (802.1t) |
|---|---|---|
| 10 Mbps | 100 | 2,000,000 |
| 100 Mbps | 19 | 200,000 |
| 1 Gbps | 4 | 20,000 |
| 10 Gbps | 2 | 2,000 |
| 25 Gbps | — | 800 |
| 40 Gbps | — | 500 |
| 100 Gbps | — | 200 |
The original short scale ran out of numbers above 10 Gbps (everything costs “about the same”), so 802.1t defined the long scale: 20,000,000,000,000 divided by the speed in bps. That’s where the two values worth memorizing come from: 1G = 20,000 and 10G = 2,000. Watch out on mixed networks: if one switch speaks short and another long, path decisions can get absurd. The STP cost calculator adds up full paths in both scales and tells you who wins as root.
LAG: adding links up, fine print included
When one link isn’t enough, the natural move is laying another one next to it and bundling them with LAG/LACP (802.1AX, formerly 802.3ad). It works, STP sees the bundle as a single logical link and blocks nothing. But the fine print matters: the switch picks which member carries each frame using a hash of the source/destination MACs, IPs or ports. Every frame of a given flow produces the same hash and rides the same member — otherwise packets would arrive out of order. Direct consequence: 4×1G gives you 4 Gbps aggregate, but a single flow never exceeds 1 Gbps. Your NAS backup running over one TCP session has no idea the other three cables exist.
There’s a lesser-known trap too: the hash doesn’t distribute across members, it distributes across buckets, and bucket counts are usually a power of 2 (8 is typical). With 2 or 4 members the split is perfect. With 3 members, 8 buckets split 3, 3 and 2: two members each get 37.5% of the flows and the third gets only 25%. With many similar flows, that imbalance shows. The LAG calculator shows the exact split and the per-flow ceiling for any combination.
Multicast at L2: 32 IPs, one MAC
Last piece inside the box: when a camera streams to an IPv4 multicast group, the frame carries nobody’s MAC in particular. A special MAC is built instead: the prefix 01:00:5e plus the lower 23 bits of the group IP. And here’s a lovely detail: a multicast IP has 28 group bits (the first 4 are fixed, 1110), but only 23 fit in the MAC. Five bits get dropped, so 2⁵ = 32 different IP addresses share the very same MAC. For instance, 224.1.1.1, 225.1.1.1 and 239.129.1.1 all land on 01:00:5e:01:01:01.
The takeaway: filtering multicast by MAC at layer 2 is never exact — the switch (via IGMP snooping) may hand you traffic from a “neighboring” group colliding on the same MAC, and the fine-grained discard happens at the receiver’s IP layer. IPv6 is more generous: prefix 33:33 plus the last 32 bits of the address. The multicast IP ↔ MAC converter shows you the resulting MAC and the 31 IPs that collide with yours — handy when the corporate TV stream shows up in the wrong VLAN.
Open your own box
Now you know what’s inside: a table that learns by reading return addresses, 4-byte tags that raise walls, a tree that cuts loops, and hashes that deal out flows. Go log into your switch: read the MAC table, check who your root bridge is (and whether it deserves the job), and work out the real pps of your links with the frame calculator — before the next two-meter cable does it for you.