More Answers: Switch Forwarding and What Happens Next

By certskills April 13, 2015 09:05

This post wraps up the discussion of the to the question listed in this earlier post – a question copied from the exam bank that comes with the ICND1 Official Cert Guide. Today’s post discussed answers D and E, at least D and E as listed in the original question. (Look here for the discussion of answers A, B, and C.) Ask’em if you’ve got’em!

Answers D and E use wording that both begin with the same phrase:

“If the next frame sent by PC1 was addressed to PC3’s MAC address…”

That phrase tells us a lot, at least if you interpret the words in the way I intended. Specifically, it tells us that the destination MAC is PC3’s unicast MAC address.

Knowing that, you then have to apply the general forwarding logic on any switch: forward unicasts out the one port listed if the MAC address is in the MAC address table, or flood the frame as an unknown unicast if it’s not in the MAC address table. In this case, per the MAC address table on switch SW1, PC3’s MAC is not listed, so SW1 will flood the frame. (See the original question post for PC1’s ARP table and SW1’s MAC address table.)

What does flooding mean, in context? Figure 1 duplicates the diagram from the question. Flooding says: forward the frame out all interfaces, in the same VLAN, except the interface in which the frame arrived. In this case, the frame would arrive on SW1’s F0/3 interface, so flooding would not send it back out F0/3. The question assumed that all the interfaces in the diagram were in the same VLAN. So SW1 floods the frame out interfaces F0/1 and F0/2, making answer E also correct.

Figure 2: Topology, Question SE-I1-822-07-001


Answers among A, B, and C:

B is correct, A and C are incorrect.


Answers among D and E:

Answer E is correct, while answer D is incorrect.

Answers: Switch Forwarding and What Happens Next
Password Config Question
By certskills April 13, 2015 09:05
Write a comment


  1. adrikayak November 8, 05:13

    Is there an errata at line 8?
    It says “J Specifically, it tells…”

    Reply to this comment
  2. Luca January 28, 12:37

    Hi Wendel the point is in the beginning PC1 already has an ARP entry for PC3’s MAC add and IP Address but SW1 has no entry in its MAC Table for PC3’s MAC on port Fa0/1.That’s so could that happen?SW1 was inserted in the lan after PC1 ARPed for PC3?PC3 has been down and it’s entry was deleted from SW1’s MAC Table ?I don’t see any other reason for SW1 not having a MAC Table entry for PC3’S MAC am i wrong?

    Reply to this comment
    • CCENTSkills February 1, 20:12

      There are other reasons why the MAC table entry can be removed, but the overriding point is that the MAC table is independent, and we shouldn’t assume it’s full just because the ARP cache is full. EG:
      – engineer clears the MAC table
      – MAC table fills (they have finite sizes, cheaper switches usually with less space; least recently used entries are removed), removing the entry.
      – host ARP cache timeout configured to be longer than switch MAC table timeout

      That said, statistically, it’s probably more likely that if there’s an ARP entry, there’s a MAC table entry on the neighboring switch – but it’s important to know that’s coincidental, not because of some mechanism.

      Reply to this comment
  3. Ben Tauler (@bentauler) January 8, 10:06

    Hi, I’ve read both answers, and I’m still confused, so correct answers are B and E. Or Only E, or D and E.

    Reply to this comment
    • certskills Author January 14, 13:49

      Hi Ben,
      Yeah, I see what you mean, the letter answers were well hidden. I just updated this post, and the one before it which discussed answers A, B, C, to explicitly list the answers at the bottom of each post. I’ll not list them here, just to avoid spoiling it for others, but check the bottom of this post for the letter answers. And thanks for the heads up.

      Reply to this comment
  4. Ray January 28, 09:59

    Why is answer D also correct?
    The word ‘only’ confuses me. If we were to remove answer E from the question, is D still correct? SW1 would ‘only’ forward the frame out its fa0/2? If SW1 is flooding the frame, wouldn’t it forward it via both Fa0/1 ‘and’ Fa0/2?
    thanks for your time

    Reply to this comment
    • certskills Author February 1, 13:26

      Hi Ray,
      I believe your logic is correct. After reviewing all three posts for this question, answer D is incorrect for the reasons you suggest. SW1 will flood the frame, sending it out ports F0/1 and F0/2, making answer D incorrect. Sorry about the mistake, but thanks for the comment so I could give it some attention.

      Reply to this comment
  5. patlegislador January 30, 12:19

    I’m confused as to how D is a correct answer? Since the switch does not have PC3-MAC, it’s going to flood ports 2 and 1.

    The answer D only says port 2.

    Reply to this comment
View comments

Write a comment

Comment; Identify w/ Social Media or Email


Subscribe to our mailing list and get interesting stuff and updates to your email inbox.

Thank you for subscribing.

Something went wrong.