More Answers: Switch Forwarding and What Happens Next

By certskills April 13, 2015 09:05

This post wraps up the discussion of the to the question listed in this earlier post – a question copied from the exam bank that comes with the ICND1 Official Cert Guide. Today’s post discussed answers D and E, at least D and E as listed in the original question. (Look here for the discussion of answers A, B, and C.) Ask’em if you’ve got’em!

Answers D and E use wording that both begin with the same phrase:

“If the next frame sent by PC1 was addressed to PC3’s MAC address…”

That phrase tells us a lot, at least if you interpret the words in the way I intended. Specifically, it tells us that the destination MAC is PC3’s unicast MAC address.

Knowing that, you then have to apply the general forwarding logic on any switch: forward unicasts out the one port listed if the MAC address is in the MAC address table, or flood the frame as an unknown unicast if it’s not in the MAC address table. In this case, per the MAC address table on switch SW1, PC3’s MAC is not listed, so SW1 will flood the frame. (See the original question post for PC1’s ARP table and SW1’s MAC address table.)

What does flooding mean, in context? Figure 1 duplicates the diagram from the question. Flooding says: forward the frame out all interfaces, in the same VLAN, except the interface in which the frame arrived. In this case, the frame would arrive on SW1’s F0/3 interface, so flooding would not send it back out F0/3. The question assumed that all the interfaces in the diagram were in the same VLAN. So SW1 floods the frame out interfaces F0/1 and F0/2, making answer E also correct.

Figure 2: Topology, Question SE-I1-822-07-001


Answers among A, B, and C:

B is correct, A and C are incorrect.


Answers among D and E:

Answer E is correct, while answer D is incorrect.

Answers: Switch Forwarding and What Happens Next
Password Config Question
By certskills April 13, 2015 09:05
Notify of

Your e-mail address will not be published.
Required fields are marked*


Newest Most Voted
Inline Feedbacks
View all comments
November 8, 2016 5:13 am

Is there an errata at line 8?
It says “J Specifically, it tells…”

Reply to  adrikayak
November 9, 2016 8:24 am

Yep! Fixed it. Thanks, Wendell

January 28, 2018 12:37 pm

Hi Wendel the point is in the beginning PC1 already has an ARP entry for PC3’s MAC add and IP Address but SW1 has no entry in its MAC Table for PC3’s MAC on port Fa0/1.That’s so could that happen?SW1 was inserted in the lan after PC1 ARPed for PC3?PC3 has been down and it’s entry was deleted from SW1’s MAC Table ?I don’t see any other reason for SW1 not having a MAC Table entry for PC3’S MAC am i wrong?

Reply to  Luca
February 1, 2018 8:12 pm

There are other reasons why the MAC table entry can be removed, but the overriding point is that the MAC table is independent, and we shouldn’t assume it’s full just because the ARP cache is full. EG:
– engineer clears the MAC table
– MAC table fills (they have finite sizes, cheaper switches usually with less space; least recently used entries are removed), removing the entry.
– host ARP cache timeout configured to be longer than switch MAC table timeout

That said, statistically, it’s probably more likely that if there’s an ARP entry, there’s a MAC table entry on the neighboring switch – but it’s important to know that’s coincidental, not because of some mechanism.

Ben Tauler (@bentauler)
January 8, 2022 10:06 am

Hi, I’ve read both answers, and I’m still confused, so correct answers are B and E. Or Only E, or D and E.

January 28, 2022 9:59 am

Why is answer D also correct?
The word ‘only’ confuses me. If we were to remove answer E from the question, is D still correct? SW1 would ‘only’ forward the frame out its fa0/2? If SW1 is flooding the frame, wouldn’t it forward it via both Fa0/1 ‘and’ Fa0/2?
thanks for your time

January 30, 2022 12:19 pm

I’m confused as to how D is a correct answer? Since the switch does not have PC3-MAC, it’s going to flood ports 2 and 1.

The answer D only says port 2.