Switching and MAC addresses

Why it matters

Before a packet can cross the internet it must cross the first cable, and that hop works by entirely different rules from IP routing. Layer 2 is where virtual IP failover works (or does not), where a stale ARP entry sends traffic to a dead server, where a misconfigured VLAN isolates a fleet, and where a single cabling loop can melt a network in seconds. Cloud networks hide much of this, but the concepts still appear in failover designs and every on-premise outage review.

The idea

Inside one local network, devices are identified by MAC addresses: 48-bit hardware identifiers like 3c:22:fb:9a:10:4e, burned into each network interface (and often randomised by phones for privacy). A switch connects devices and forwards each frame only out of the port where the destination MAC lives. IP addresses say where in the world a host is; MAC addresses say which neighbour to hand the frame to next.

How a switch learns

A switch starts knowing nothing. When a frame arrives on a port, it records "this source MAC lives on this port" in its MAC table. To forward a frame, it looks up the destination MAC: if known, it sends the frame only to that port; if unknown, it floods it to every port except the one it came in on. Replies teach it the rest. Entries age out after a few minutes so moved devices are relearned.

ARP: from IP address to MAC address

A host that wants to send an IP packet to 10.0.0.7 on its own subnet needs that host's MAC. It broadcasts an ARP request ("who has 10.0.0.7?") to every device on the segment; the owner replies with its MAC, and the sender caches the answer for minutes. For destinations outside the subnet, the host ARPs for its default gateway (the router) instead and sends every remote packet to the router's MAC, which is how traffic leaves the local network.

1. 1

   Check the destination

   Is the destination IP in my subnet? If yes, ARP for it; if not, ARP for the gateway.
2. 2

   Look in the ARP cache

   If the IP to MAC mapping is cached, use it.
3. 3

   Otherwise broadcast

   Send 'who has 10.0.0.7?' to the broadcast MAC ff:ff:ff:ff:ff:ff; the owner answers directly.
4. 4

   Send the frame

   Wrap the IP packet in an Ethernet frame addressed to that MAC.

Gratuitous ARP is a host announcing its own IP to MAC mapping unprompted, used by failover systems: when a standby takes over a virtual IP, it broadcasts a gratuitous ARP so every neighbour updates its cache and traffic shifts in seconds. ARP has no authentication, which is why ARP spoofing (claiming someone else's IP) is a classic attack on shared networks.

Broadcast domains and VLANs

Every device that receives a broadcast forms a broadcast domain. Large flat layer 2 networks waste capacity on broadcast chatter and spread failures widely, so networks are split. VLANs carve one physical switch fabric into several isolated layer 2 networks, tagging frames with a VLAN ID; traffic between VLANs must go through a router or firewall, which is how office, server and guest networks are separated on the same hardware.

Loops and spanning tree

Frames carry no time-to-live, so if switches are cabled in a loop, a flooded broadcast circulates forever and multiplies, saturating every link within seconds: a broadcast storm. The spanning tree protocol prevents this by having switches agree to disable redundant links, leaving a loop-free tree, and re-enable them if an active link fails. Modern data centres avoid large layer 2 domains altogether and route at layer 3 between racks, keeping layer 2 small.

Trade-offs

Layer 2 is simple and needs no configuration to connect devices, at the cost of broadcasts, flooding and loop risk that grow with network size. VLANs add isolation without new hardware but add configuration that can go wrong silently. Spanning tree buys loop safety by leaving redundant links idle. Routing at layer 3 scales better and is what large networks and clouds do, at the cost of planning IP addressing.

In an interview

It appears in failover and debugging: "The database pair shares a virtual IP; on failover the new primary sends gratuitous ARP so clients' caches update immediately rather than after the ARP timeout." Or: "Hosts in the same VPC subnet can talk directly at layer 2 semantics, but cross-subnet traffic goes via the router, so security groups and route tables both matter."