redzilla
Layer 2

Inside the Switch: MAC, VLANs & STP

A switch looks like a dumb box with blinking lights, but a lot happens inside: MAC tables, VLAN tags, a loop-killing tree and links that add up. Let’s open the box.

≈ 14 min read

One Monday at 8:30 a school called me in a panic: “the whole network is dead, the switch must have burned out.” The culprit was a two-meter patch cable that someone, meaning well, had plugged between two wall jacks “so it wouldn’t dangle.” That cable created a loop, the loop spawned a broadcast storm, and the storm took 800 students offline. To understand how two meters of copper can flatten an entire building — and why they almost never manage to — you have to open the switch and look inside. Spoiler: there’s no magic in there. There’s a table, some tags, and a tree.

How a switch learns (no magic involved)

Picture a building concierge on their first day, knowing nobody. Every time a resident hands over a letter to mail out, the concierge glances at the return address and jots down: “Mrs. Pérez lives in 402.” No questions, no guessing: they learn by watching where things come from. A switch does exactly that with every frame it receives: it reads the source MAC and notes in its table, “this MAC lives behind this port.”

When a frame arrives for a known destination, the switch forwards it out that one port only. And if the destination isn’t in the table? The concierge shouts across the lobby: the frame is flooded out every port except the one it came in on. Whoever answers gets learned, and the next delivery goes direct. Broadcasts (destination ff:ff:ff:ff:ff:ff) are always flooded, by definition. And since residents move out, table entries expire: the default aging timer is 300 seconds without seeing traffic from that MAC.

access-sw-1 — show mac address-table
Vlan    Mac Address        Type      Ports
----    -----------        ----      -----
  10    b4:96:91:1a:2f:03  DYNAMIC   Gi1/0/07
  10    f4:39:09:55:c0:11  DYNAMIC   Gi1/0/12
  20    00:11:32:8b:44:9e  DYNAMIC   Gi1/0/24
Total Mac Addresses for this criterion: 3
To physically hunt down a mystery device: look up its MAC in the switch table and you’ve got the exact port. If all you have is the MAC and no idea what the box is, the OUI vendor lookup tells you who built it, and the MAC toolkit normalizes the format when the switch prints dots and your inventory uses colons.

The frame: an envelope with 20 invisible bytes

The envelope traveling down the wire has a fixed layout: destination MAC (6 bytes), source MAC (6), EtherType (2, declaring what’s inside: IPv4, IPv6, ARP…), the payload (46 to 1500 bytes) and the FCS (a 4-byte checksum at the end). Legal minimum: 64 bytes. Classic maximum: 1518.

But the wire charges more than Wireshark shows you. Before every frame come 8 bytes of preamble + SFD (a clapperboard that syncs the clocks), and after it come 12 bytes of IFG, the mandatory silence between frames. That’s 20 bytes per frame no capture will ever display, yet they burn wire time all the same. With small frames, that tax hurts.

Ethernet frame to scale with the 802.1Q tag inserted between source MAC and EtherType, plus the invisible preamble and IFG the VLAN tag slots in here (+4 B) 8 B 6 B 6 B 4 B 46–1500 B 4 B 12 B PREAMBLE+SFD DST MAC SRC MAC 802.1Q ETHERTYPE 2 B PAYLOAD FCS IFG Preamble + IFG = 20 extra bytes per frame: never shown in Wireshark, always on the wire.
The frame to scale (payload compressed). Dashed fields are the 20 “invisible” bytes; the 802.1Q tag is inserted inside the frame.

Those 20 bytes explain the most quoted — and least understood — number in switching: how many frames per second a link can carry. Let’s run it at 1 Gbps with minimum-size frames:

  1. The smallest legal frame is 64 bytes: 6 (destination) + 6 (source) + 2 (EtherType) + 46 (payload) + 4 (FCS).
  2. Add the invisible tax: 8 bytes of preamble+SFD and 12 of IFG. On the wire it occupies 64 + 20 = 84 bytes.
  3. Convert to bits: 84 × 8 = 672 bits per frame.
  4. Divide the line rate: 1,000,000,000 ÷ 672 = 1,488,095 frames/s ≈ 1.49 Mpps. That’s the theoretical ceiling of a gigabit port under small-frame traffic (think VoIP, or attacks).
  5. Sanity check: with 1518 B frames it’s 1,538 × 8 = 12,304 bits, i.e. just 81,274 pps. Same link, 18 times fewer packets — which is why firewalls are specced in pps, not just Gbps.

Want to play with other sizes and speeds without a spreadsheet? The Ethernet frame & PPS calculator runs exactly this math from 1G to 100G, with and without a VLAN tag.

VLAN 802.1Q: virtual walls inside the same box

A VLAN turns one physical switch into several logical ones: cameras on one side, guests on another, and neither sees the other’s broadcasts. The mechanism is almost embarrassingly simple: a 4-byte tag inserted inside the frame, between the source MAC and the EtherType (see the diagram above). Two bytes of TPID (0x8100, “heads up, this is tagged”) and two bytes carrying the PCP (3 priority bits, values 0 to 7), the DEI bit and the 12-bit VLAN ID: 4096 values, of which 4094 are usable (0 and 4095 are reserved).

Back to the building. An access port is an office door: everything coming out of it belongs to that office, so nobody wears a badge indoors — the switch pins the tag on when the envelope enters the hallway and peels it off on delivery. A trunk port is the shared mailroom corridor: envelopes from every office travel through it, each with its sticker on, because without stickers nobody could tell which office owns what. Access = one port, one VLAN, untagged. Trunk = many VLANs, all tagged.

The 3 PCP bits (802.1p) are the “fragile” stamp on the envelope: mark voice with priority 5 or 6 so the switch ships it out ahead of the Windows Update download. And when a service provider hauls your VLANs across its network, it uses Q-in-Q (802.1ad): it wraps your frame, tag and all, inside a tag of its own (the S-TAG, TPID 0x88a8). An envelope inside an envelope: you keep your 4094 VLANs untouched and the provider moves you around as a single customer. The maximum frame grows to 1522 B with one tag and 1526 B with two. You can dissect any tag bit by bit with the VLAN decoder and build the double tagging with the Q-in-Q tool.

On an 802.1Q trunk, the native VLAN travels untagged. If both ends disagree on which one it is, traffic silently leaks from one VLAN into another — no error, no log, just weirdness. Pin the native VLAN explicitly on both sides.

STP: the tree that puts out the storm

Now, back to that school cable. Layer 2 has no TTL: a frame can circle forever. Connect two switches with two cables (or one wall jack to another) and every broadcast entering the ring gets forwarded, comes back, gets forwarded again… and since each switch floods it out every port, it doesn’t just loop — it multiplies. Within seconds the links saturate with copies of the same ARP — remember the ceiling: up to 1.49 million frames per second on every gigabit port — CPUs choke, and MAC tables go haywire watching the same source MAC arrive on two ports at once (MAC flapping). That’s a broadcast storm, and it doesn’t fix itself: it stops when the loop is cut.

Spanning Tree (STP/RSTP) cuts the loop for you, deliberately and with criteria. First the switches elect a root bridge: lowest bridge ID wins, which is the priority (0 to 61440 in steps of 4096, default 32768) followed by the MAC address. On a priority tie, the lowest MAC wins — which is usually the oldest switch in the closet, not the best one. Then every switch computes its cheapest path to the root by adding up each link’s cost, keeps that port as its root port, and every redundant link ends up with one blocked port: still there, still listening to BPDUs, ready to take over if the main path dies.

SpeedShort cost (802.1D-1998)Long cost (802.1t)
10 Mbps1002,000,000
100 Mbps19200,000
1 Gbps420,000
10 Gbps22,000
25 Gbps800
40 Gbps500
100 Gbps200

The original short scale ran out of numbers above 10 Gbps (everything costs “about the same”), so 802.1t defined the long scale: 20,000,000,000,000 divided by the speed in bps. That’s where the two values worth memorizing come from: 1G = 20,000 and 10G = 2,000. Watch out on mixed networks: if one switch speaks short and another long, path decisions can get absurd. The STP cost calculator adds up full paths in both scales and tells you who wins as root.

Triangle of three switches where STP elects SW1 as root bridge and blocks SW3's port toward SW2 SW1 · ROOT prio 4096 · MAC …:01 SW2 prio 32768 · MAC …:22 SW3 prio 32768 · MAC …:33 1G · cost 20,000 1G · cost 20,000 1G · cost 20,000 DP DP RP RP DP BLOCKED (ALT) Cost tie to root (20,000): on SW2–SW3 the higher bridge ID blocks → SW3.
STP on the classic triangle: SW1 wins root with priority 4096; SW3 blocks its port toward SW2 and the loop is cut.
The classic: someone brings a desktop switch into a meeting room and plugs it in with two cables “so it stays put.” If your access ports don’t run BPDU guard (or worse, someone disabled STP “because it slowed the network down”), you just bought a broadcast storm with a side of downtime. Never turn STP off; enable BPDU guard on every user-facing port, and choose your root bridge yourself with priority — don’t let chance pick it via the oldest MAC in the rack.

LAG: adding links up, fine print included

When one link isn’t enough, the natural move is laying another one next to it and bundling them with LAG/LACP (802.1AX, formerly 802.3ad). It works, STP sees the bundle as a single logical link and blocks nothing. But the fine print matters: the switch picks which member carries each frame using a hash of the source/destination MACs, IPs or ports. Every frame of a given flow produces the same hash and rides the same member — otherwise packets would arrive out of order. Direct consequence: 4×1G gives you 4 Gbps aggregate, but a single flow never exceeds 1 Gbps. Your NAS backup running over one TCP session has no idea the other three cables exist.

There’s a lesser-known trap too: the hash doesn’t distribute across members, it distributes across buckets, and bucket counts are usually a power of 2 (8 is typical). With 2 or 4 members the split is perfect. With 3 members, 8 buckets split 3, 3 and 2: two members each get 37.5% of the flows and the third gets only 25%. With many similar flows, that imbalance shows. The LAG calculator shows the exact split and the per-flow ceiling for any combination.

LAG hash distributing 8 buckets across 3 members: two members get 3 buckets each and one gets 2 hash(src+dst MAC/IP) mod 8 0 1 2 3 4 5 6 7 member 1 · 3/8 = 37.5% member 2 · 3/8 = 37.5% member 3 · 2/8 = 25% Each flow lands in one bucket and rides ONE member: 4×1G is never 4G for a single flow.
With 3 members and 8 buckets the split is 3/3/2: member 3 gets only 25% of the flows. Powers of 2 split evenly.

Multicast at L2: 32 IPs, one MAC

Last piece inside the box: when a camera streams to an IPv4 multicast group, the frame carries nobody’s MAC in particular. A special MAC is built instead: the prefix 01:00:5e plus the lower 23 bits of the group IP. And here’s a lovely detail: a multicast IP has 28 group bits (the first 4 are fixed, 1110), but only 23 fit in the MAC. Five bits get dropped, so 2⁵ = 32 different IP addresses share the very same MAC. For instance, 224.1.1.1, 225.1.1.1 and 239.129.1.1 all land on 01:00:5e:01:01:01.

The takeaway: filtering multicast by MAC at layer 2 is never exact — the switch (via IGMP snooping) may hand you traffic from a “neighboring” group colliding on the same MAC, and the fine-grained discard happens at the receiver’s IP layer. IPv6 is more generous: prefix 33:33 plus the last 32 bits of the address. The multicast IP ↔ MAC converter shows you the resulting MAC and the 31 IPs that collide with yours — handy when the corporate TV stream shows up in the wrong VLAN.

Open your own box

Now you know what’s inside: a table that learns by reading return addresses, 4-byte tags that raise walls, a tree that cuts loops, and hashes that deal out flows. Go log into your switch: read the MAC table, check who your root bridge is (and whether it deserves the job), and work out the real pps of your links with the frame calculator — before the next two-meter cable does it for you.

Tools to practice with