Unicast traffic on my 4003 switch ports? 1

[AkChinJim]

I am confused about the traffic I am seeing on a 100BaseTX port. I was expecting broadcast and multicast traffic as well as unicast traffic replying to the single IP/MAC address of my laptop network analyser. I am seeing unicast traffic between different IP addresses. The unicast traffic is not all traffic going through the switch though. SPAN is turned off.

Was disappointed to learn the 4000 switches share bandwidth between groups of ports. Does the oversubscibing of ports also allow transmission of all traffic between those ports? Is this like having a bunch of 4 port hubs in an expensive switch?

 

[krr]

When a switch does not find the destination MAC address of a frame in it's forwarding database it floods this frame out on all ports (belonging to the same VLAN, to be precise). This is normal behaviour. When the destination sends a frame, it's (source) MAC address will be learned and bound to a port so that flooding stops. When there are no frames from this source for a certain amount of time (ageing timer, usually 2 Minutes) the address is removed from the database.

There is a maximum number of entries that the forwarding database can hold (1000 on some cheap boxes, 8000 ore more on "real" ones). Overflow handling strategy varies. Some start flooding everything, some block, some crash... I don't know the specific details for Cisco switches.

> ...4000 switches share bandwidth between groups of ports...

Can you - or somebody else - tell me more about this? Which linecards?

Cheers *Rob

 

[AkChinJim]

Thanks for clarifying the mystery. I should have known that, but never associated the way transparent bridges learn MAC address with what it looks like on a sniffer.

* 4000 switches share bandwidth *

A few more details about oversubscribing ports -

It depends on the model switch module you purchase whether ports are oversubscribed. The WS-X4448-GB-LX module for instance oversubscribes ports 1, 3, 5, 7, 9, 11, 13, 15 as a group, 2, 4, 6, 8, 10, 12, 14, 16 as another group, etc. Ports within the group share 1 GB of bandwidth. Looks like the WS-X4448-GB-RJ45 module does not oversubscribe ports. Probably is a price difference - but I only make this stuff work - don't have to pay for it.

Check out

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/hw_doc/mod_inst/01overvw.htm#xtocid7

for more info.

Thanks again for the reply.