Learn about three of the four types of switch messages in one minute: broadcast, multicast, and unknown unicast

With the development of the Internet, various applications emerge in an endless stream, changing with each passing day, and the requirements for network equipment are getting higher and higher, and more requirements are also put forward for the majority of equipment manufacturers. However, these things have nothing to do with the layer 2 switch:), because when the data of various applications reaches the layer 2 switch, they will only become one data packet (frame), and the switch basically does not identify which type of application it belongs to.

For a Layer 2 switch, there are only four types of messages when forwarding messages: broadcast, multicast, unknown unicast, and known unicast. Although it seems simple, based on my years of experience, not many people can understand these four message forwarding mechanisms. Most people have always been confused, but they have successfully survived for so many years:). Today, we will first look at three of these four messages: broadcast, multicast, and unknown unicast. The next article will introduce known unicast separately.

The switch handles broadcast, multicast, and unknown unicast messages in the same way.

As the saying goes, "Birds of a feather flock together." Some of you may have questions. Broadcast, multicast, and unknown unicast messages seem to be quite different and have no connection. Why should they be discussed together?

In this world, people always follow their own opinions. These messages are different for us, but for a Layer 2 switch, the way to handle these three messages is the same: flood them, so they will be discussed together.

However, before explaining flooding, let us first understand what Layer 2 broadcast, multicast, and unknown unicast messages are.

1. Layer 2 broadcast message

When a Layer 2 switch receives a message, it extracts the destination MAC address of the message. If the MAC address is all FF, then the message is a Layer 2 broadcast message, such as the following Wireshark packet capture screenshot:

Layer 2 broadcast message

2. Layer 2 multicast messages

If the MAC address of the message received by the Layer 2 switch starts with 000:01:5E, then this message is a Layer 2 multicast message, such as the following wireshark capture:

Layer 2 multicast message

3. Unknown unicast message

What is an unknown unicast message? First of all, it is a unicast message. So what is a unicast message? Simply put, all messages other than broadcast and multicast are unicast messages, that is, messages whose destination MAC address is neither all Fs nor starts with 01:00:5E. For example, the following wireshark packet capture content is a unicast message:

Layer 2 unicast message

So what are unknown unicast messages? They are unicast messages that have no entries in the switch MAC address table, such as the following figure:

MAC address table

When the switch receives a message with a destination MAC address of 0000:2222:2222, it searches the MAC address table and finds that there is no entry. It then considers the message to be an unknown unicast message.

On the contrary, when the switch receives a message with a destination MAC address of 0000:1111:1111, it can find the entry in the table and considers the message to be a known unicast message.

The Layer 2 switch floods all three types of messages.

We have learned how switches identify the type of a message, and we have also learned that Layer 2 switches handle broadcast, multicast, and unknown unicast in the same way. So how do we handle them? There is a special term in the network world called flooding, which is specially designed for them!

Flooding means flooding, which means filling up all the gaps like a flood, leaving no space. The same is true in switches. When a port receives any of the above-mentioned messages, it will be forwarded from all ports in the same VLAN that are UP, as shown in the following figure:

Packet flooding

When the switch port P1 receives any of the broadcast, multicast, and unknown unicast messages, it will make four copies inside the switch and then forward them from the four ports P2-P5. Just like a flood filling up all the gaps, the switch will also send the message out from all ports!

Summarize

After the above explanation, you should have a certain understanding of the mechanism of Layer 2 switch processing messages. Let me make a brief summary:

• In the world of Layer 2 switches, messages are divided into only four categories: broadcast, multicast, unknown unicast, and known unicast;
• A Layer 2 broadcast message is a message whose destination MAC is all Fs, i.e. FF:FF:FF:FF:FF:FF;
• Layer 2 multicast messages refer to messages whose destination MAC starts with 01-00-5E;
• Layer 2 unknown unicast refers to unicast packets that are not broadcast or multicast in MAC and have no table entry in the switch;
• The switch handles broadcast, multicast, and unknown unicast in the same way: flooding;