Learn about the last of the four types of switch messages in one minute: known unicast

Continuing from the previous article "Learn three of the four types of switch messages in one minute: broadcast, multicast, and unknown unicast"

90% of the traffic transmitted by the Layer 2 switch is known unicast

In the previous article, we talked about how Layer 2 switches divide messages into four categories when forwarding messages: broadcast, multicast, unknown unicast, and known unicast. Although the first three types of messages look different, Layer 2 switches handle them in the same way: flood forwarding. Today we will introduce the last type: known unicast. Because the switch handles it differently from the other three types of messages, we will introduce it separately today!

In a daily working environment, more than 90% of the packets forwarded normally by a Layer 2 switch are known unicast packets. If not, it means that there is a problem with the network, there may be a loop or the switch is being attacked.

In order to take care of those who are new to the network, let's first popularize the concept of known unicast!

In the switch MAC address table, there is a message with an entry, called a known unicast

Every time the switch receives a message, it will extract its destination MAC address and then search the MAC address table to see if there is an entry corresponding to the destination MAC:

• If there is an entry, the received message is called a known unicast message;
• If there is no entry, the received message is called an unknown unicast message.

For example, the MAC address table of a switch is as follows:

MAC address entry

• If the switch receives a message with a destination MAC of 0000-0011-1111, it searches the MAC address table and finds an entry, then the message is called a known unicast message;
• If the switch receives a message with a destination MAC of 0000-0033-3333, it searches the MAC address table and finds that there is no entry, then the message is called an unknown unicast message.

For known packets, the Layer 2 switch will forward them from a specific interface.

In our previous article, we said that switches will perform flooding for broadcast, multicast, and unknown unicast messages. So how do switches handle known unicast messages?

• The switch will only forward known packets from a specific port;
• The other three types of messages will be forwarded through all UP ports in the same VLAN.

For example, in the MAC address table below, when the switch receives a packet with a destination MAC of 0000-0011-1111, it will only forward it from G0/0/1 and will not forward it from G0/0/2.

It will only be forwarded from G0/0/1

This is also the biggest feature of known unicast!

Summarize

As mentioned above, more than 90% of the traffic on the network is known unicast. Can you guess why?

Because the normal forwarded message must have an outbound interface, if not, the traffic will be flooded! We know that flooded traffic will be copied multiple times and sent out from multiple interfaces! This forwarding method will not only waste the resources of the switch, but also occupy a lot of bandwidth, which should not exist (a small amount is acceptable). If there is a large amount of flooded traffic, it means that there is a problem with the network, and the network failure needs to be eliminated. At the same time, measures should be taken to limit the transmission of flooded traffic!