Routing & Switching
How switches learn MAC addresses, how routers forward packets, VLANs, and reading a routing table.
Learning Objectives
- → Explain how a switch builds its MAC address table
- → Read and interpret a Linux routing table
- → Understand VLAN segmentation and its security benefits
- → Use traceroute to follow packet paths
Switching — Layer 2 Forwarding
A switch learns which devices are on which port by observing incoming frames.
MAC Address Table (CAM Table)
Port | MAC Address | VLAN
-----|--------------------|----|
1 | AA:BB:CC:11:22:33 | 1
2 | DD:EE:FF:44:55:66 | 1
3 | 00:11:22:33:44:55 | 10
Learning process:
1. Frame arrives on Port 1 from MAC AA:BB:CC:...
2. Switch records: Port 1 → AA:BB:CC:...
3. Frame destined for DD:EE:FF:... → check table → send to Port 2
4. Unknown destination → flood to all ports (except source)
ARP & MAC Interplay
Before a host can send data to another host on the same LAN:
1. Check ARP cache for target IP
2. If missing → broadcast ARP Request: "Who has 192.168.1.5?"
3. Target replies with its MAC address
4. Now the frame can be addressed to the correct MAC
Routing — Layer 3 Forwarding
A router uses IP routing tables to decide where to forward packets.
Routing Table
ip route show
# or: route -n (Linux)
# or: netstat -rn (legacy)
# Output:
192.168.1.0/24 dev eth0 proto kernel # directly connected
0.0.0.0/0 via 192.168.1.1 dev eth0 # default route
10.0.0.0/8 via 192.168.1.254 dev eth0 # static route
Static vs Dynamic Routing
| Static | Dynamic | |
|---|---|---|
| Config | Manual | Automatic via protocol |
| Overhead | None | CPU/bandwidth for updates |
| Scalability | Small networks | Large networks |
| Examples | ip route add |
OSPF, BGP, EIGRP |
Traceroute — Following the Path
traceroute google.com # Linux
tracert google.com # Windows
# Each line = one hop (router)
# 1 192.168.1.1 1.2ms ← your home router
# 2 10.0.0.1 8.4ms ← ISP router
# 3 72.14.215.1 12.1ms ← Google's edge
# ...
VLANs — Virtual LANs
VLANs logically segment a physical switch into multiple isolated broadcast domains.
Without VLANs: All devices on a switch share the same broadcast domain — any broadcast reaches every device.
With VLANs:
Switch Port 1–5 → VLAN 10 (HR)
Switch Port 6–10 → VLAN 20 (Engineering)
Switch Port 11 → VLAN 30 (Servers)
HR can't communicate with Engineering unless traffic goes through a router (inter-VLAN routing).
Security Benefits of VLANs
- Isolation — compromise of one VLAN doesn't spread to others
- Reduced attack surface — HR can't see engineering traffic
- Segmented broadcast domain — fewer ARP storms
- Policy enforcement — apply firewall rules between VLANs
Trunk Links
A trunk carries multiple VLANs over one physical link using 802.1Q tagging. Each frame gets a 4-byte VLAN tag inserted.
Access port: carries one VLAN (untagged frames)
Trunk port: carries multiple VLANs (802.1Q tagged)
A switch is self-learning. It builds a MAC address table by observing which device sent each incoming frame.
| Port | MAC Address | VLAN | Age |
|---|---|---|---|
| 1 | AA:BB:CC:11:22:33 | 1 | 120s |
| 2 | DD:EE:FF:44:55:66 | 1 | 45s |
| 3 | 00:11:22:33:44:55 | 10 | 300s |
Switch reads source MAC: AA:BB:CC:11:22:33 → records Port 1 → AA:BB:CC:...
Switch checks CAM table for destination MAC.
Send frame ONLY to the correct port (unicast).
Send frame to ALL ports except source (unknown unicast flood).
When a switch receives a frame for an unknown destination MAC, it:
The MAC address table in a switch is also called:
Routers use routing tables to decide where to forward each packet. The router uses the longest prefix match rule.
| Destination | Gateway | Match For |
|---|---|---|
| 10.0.0.0/8 | 192.168.1.254 | Any 10.x.x.x packet |
| 10.1.0.0/16 | 192.168.1.100 | More specific: 10.1.x.x |
| 10.1.1.0/24 | 192.168.1.200 | Most specific: 10.1.1.x ← WINS |
| 0.0.0.0/0 | 192.168.1.1 | Everything else (default) |
What command shows the routing table on a modern Linux system?
A packet to 10.1.1.5 matches both 10.0.0.0/8 and 10.1.1.0/24. Which route wins?
VLANs logically segment a physical switch into multiple isolated broadcast domains — without needing separate physical switches.
✓ Advantages
- HR can't see Engineering traffic
- Smaller broadcast domains = less noise
- One switch — multiple virtual networks
- Enforced by 802.1Q VLAN tagging
✗ Disadvantages
- Inter-VLAN needs a router (or L3 switch)
- Misconfigured trunk = VLAN hopping attack
- Added configuration complexity
| Port Type | Carries | Frame Format | Use |
|---|---|---|---|
| Access | One VLAN only | Untagged (802.3) | End device (PC, phone) |
| Trunk | Multiple VLANs | 802.1Q tagged | Switch-to-switch / switch-to-router |
The primary security benefit of VLANs is:
A trunk port carries:
💪 Exercises & Challenges
Traceroute Analysis
## Task: Trace Packet Routes **1. Run traceroute to multiple destinations:** ```bash traceroute google.com traceroute cloudflare.com traceroute 8.8.8.8 ``` **2. Analyse the output:** - How many hops
Routing Table Challenge
Given this routing table: ``` 10.0.0.0/8 via 192.168.1.10 172.16.0.0/12 via 192.168.1.20 0.0.0.0/0 via 192.168.1.1 ``` A packet destined for `172.20.50.100` will be sent to which gateway? S