Ethernet Switching and MAC Addresses

Lesson plan

Level

Beginner

Time

About 50 minutes; the steps below add up to 49

Learners work out what every note in a busy office needs (a sender and a recipient) and how a newcomer with no seating plan would deliver one, so source and destination addresses and flooding come from them before the switch is named. They then predict how a switch could learn where devices are, check one frame before the step-through, and separate flooding from broadcasting. The habit to build: ask which address a device is reading, and why.

Objectives

• Describe a MAC address and what it does and does not identify
• Explain how a switch learns from source addresses and forwards on destination addresses
• Tell unknown-unicast flooding from broadcasting, and recognise it as normal
• Explain which switch behaviour MAC flooding abuses

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Delivery Methods and Number Systems lessons first.
• Draw a switch with four ports and an empty table on the board, to fill in as frames arrive.
• The lesson takes about 49 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Describe a MAC address and what it does and does not identify
   • Explain how a switch learns from source addresses and forwards on destination addresses
   • Tell unknown-unicast flooding from broadcasting, and recognise it as normal
   • Explain which switch behaviour MAC flooding abuses

   Purpose: Learners work out what every note in a busy office needs (a sender and a recipient) and how a newcomer with no seating plan would deliver one, so source and destination addresses and flooding come from them before the switch is named. They then predict how a switch could learn where devices are, check one frame before the step-through, and separate flooding from broadcasting. The habit to build: ask which address a device is reading, and why.

2. 1. Passing notes Think 5 min

   Purpose: Find sender and recipient labels, and flooding, from an everyday office.

   Ask

   • What must be on every note?
   • How do you deliver to someone you have never met?

   Responses to expect

   • Both names come quickly; the second question usually produces “try every desk”.
   • On screen in turns: the opening question, its answer; then the question on delivering with no seating plan, and its answer.

   Discussion pause: Let two or three learners suggest a method before revealing the explanation.

   In the lesson window

   • Think it through: Twenty people share a large open-plan office and pass paper notes to one another. What must be written on every note so that it reaches the right person, and so that an answer can come back?
   • Think it through: Someone new starts delivering the notes, with no seating plan. How can they deliver a note to a person they have never met?

3. 2. MAC addresses Explain 8 min

   Purpose: Name the MAC address, the frame, and what the address does not prove.

   Ask

   • What can a changeable address tell you?

   Responses to expect

   • Some expect it to identify the device for certain.
   • On screen in turns: the opening; then the format of a MAC address, and the frame; who sets a MAC address; the manufacturer part, the broadcast MAC and locally administered addresses; the question on what a borrowed badge tells you, and its answer; why a MAC address proves nothing about identity.

   Misconceptions to challenge

   • A learner may believe: “A MAC address is burned in and cannot change.” Respond: It can be set, randomised or copied in software.

   In the lesson window

   • Think it through: If a MAC address can be set by the device, randomised or copied, what can it tell you about the device using it?

4. 3. Learn from the source, forward towards the destination Predict 14 min

   Purpose: Build the learn-and-forward rule, then confirm it with the step-through.

   Ask

   • How could the switch work out where devices are?
   • Where does the reply go?
   • Which address is used for which job?

   Responses to expect

   • Learners often swap source and destination; the caretaker’s notebook helps.
   • Diagram: step through the four frames; before each, ask what the switch will learn and where it will send the frame.
   • On screen in turns: the opening question, its answer; then the caretaker’s notebook, starting with writing down the sender; delivering a note to a known name; delivering to an unknown name; the MAC address table, and the three devices; the check question on the printer’s reply, and its answer; an empty switch learning, frame by frame; the diagram’s stages one at a time; the completed table; the check question on what the switch reads, and its answer; three things to take from the walk-through; where the caretaker comparison stops.

   Misconceptions to challenge

   • A learner may believe: “A switch is told where each device is.” Respond: It learns from the frames it receives.

   Discussion pause: Before the switch walk-through, let the class predict what an empty switch does with the first frame.

   If the explanation does not land: Act it out: three learners as devices, one as the switch with a notebook.

   In the lesson window

   • Think it through: A switch starts with no idea which device is plugged into which port, and nobody tells it. Every frame it receives carries a source address and a destination address. How could it work out where each device is?
   • Check your understanding: An empty switch has seen one frame, from Laptop A on port 1, so it knows only “A is on port 1”. Printer B on port 2 now replies to A. Where does the switch send the reply?
   • Check your understanding: In the walk-through, which address in each frame did the switch use to learn, and which to forward?

5. 4. Unknown unicast is normal behaviour too Predict 6 min

   Purpose: Separate unknown-unicast flooding from broadcasting, and show it is normal.

   Ask

   • How does a flooded frame differ from a broadcast?

   Responses to expect

   • “They are the same” is common; ask who the frame is addressed to.
   • On screen in turns: the opening; then the question on flooding and broadcasting, and its answer; two points that prevent a common confusion; flooding on a switch divided into VLANs.

   If the explanation does not land: A new postman who does not yet know a resident knocks on every door in the block; only that resident takes the letter, and next time he goes straight to their door.

   In the lesson window

   • Think it through: A flooded frame reaches every other device on the switch. So does a broadcast frame. What is the difference?

6. 5. Where MAC flooding fits Predict 4 min

   Purpose: Show which normal behaviour MAC flooding abuses, and point to Module 4.

   Ask

   • How could the two facts be abused?

   Responses to expect

   • Filling the table is the idea to reach; the details wait for Module 4.
   • On screen in turns: the opening question, its answer; then how this normal behaviour can be abused; reading a switch’s MAC address table.

   In the lesson window

   • Think it through: A switch believes every source address it sees, and its table can hold only so many entries. How might someone abuse those two facts?

7. 6. Apply it in a new situation Apply 5 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The first tests reading the table; the second tests normal flooding; the third, memory against permission.
   • On screen in turns: the opening question, its answer; then the question on morning flooding, and its answer; the question on whether the table is permission, and its answer.

   In the lesson window

   • Apply it: An unexpected device appears on the office network, and you know its MAC address. How could the switch help you find it?
   • Apply it: Monitoring shows a switch flooding a few frames as devices connect each morning, and occasionally after lunch. A colleague wants to report an attack. What do you say?
   • Apply it: A colleague says the MAC address table proves that only Laptop A is allowed on port 1. What is wrong with that?

8. 7. Check your understanding Check 4 min

   Purpose: Check the lesson against the approved revision-bank questions.

   Ask

   • Answer individually, then compare before revealing.

   Responses to expect

   • The new-server question links back to the flooding step.
   • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

9. 8. What to remember Consolidate 3 min

   Purpose: Summarise the five points, the key terms and the misunderstandings.

   Ask

   • Without looking: which address does a switch learn from?

   Responses to expect

   • The source address, never the destination.
   • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

10. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Two addresses on every frame: who it is from and who it is for.
    • A MAC address is for delivery, not proof.
    • Learn from the source; forward on the destination.
    • Unknown destinations are flooded, and that is normal.
    • Believing every source address is the weakness MAC flooding uses.

Consolidation

• Two addresses on every frame: who it is from and who it is for.
• A MAC address is for delivery, not proof.
• Learn from the source; forward on the destination.
• Unknown destinations are flooded, and that is normal.
• Believing every source address is the weakness MAC flooding uses.