0

enter image description hereenter image description hereThe image of a network im refering to is above. In Cisco Packet Tracer after having used a command ping 192.168.1.3 from pc1 to pc3, when I check mac addresses in both SW1 and SW2 using show mac address-table(from privileged EXEC mode in SW1 CLI) I see too many mac addresses, I would expect to only see mac addresses from pc1 and pc3 in both SW1 and SW2 however there is also mac address of pc4 in both mac address-tables. However this occurs only on a first ping, when I clear mac addresses(in both switches) reapeat the ping command ping 192.168.1.3 I get only 2 mac addresses in bot switches, as exepected. Is that a Cisco packet tracer bug or am I missing some technical detail?

Improve this question

1 Answer 1

Reset to default
1

That sounds normal. When a host first comes up, it may try some broadcast communication, e.g. DHCP. After, it will not need to do that, so clearing the MAC address tables will remove it until there is some other traffic from it.

Improve this answer
10
  • From my understanding the ping command uses two messages - ICMP Echo Request and ICMP Echo Replay which are both unicast frames. Is there something more going on or do I have wrong idea? I would be grateful if you could elaborate further.
    – pieceofpaper
    Commented Jan 6 at 19:34
  • When you startup a PC that uses DHCP, it will send a broadcast message that will go everywhere, meaning that both switches will learn the MAC address of such a PC. There are other reasons a PC may send a message when it starts up, and even a unicast will need to send an ARP (broadcast) to resolve the layer-2 address from the layer-3 address for a host with an empty ARP table. You can set up a port mirror (not sure if Packet Tracer has that) to see what traffic is actually happening.
    – Ron Maupin ♦
    Commented Jan 6 at 20:06
  • But why SW1 does not remember the mac address of pc2?
    – pieceofpaper
    Commented Jan 6 at 20:28
  • Unless you capture the exact traffic, we cannot answer. Also, remember that the MAC address tables in the switches and the ARP tables in the host will time out entries. Cisco switches can have the timeout period configured.
    – Ron Maupin ♦
    Commented Jan 6 at 20:41
  • I added the picture of what I believe depicts traffic. Could you say something more seeing this?
    – pieceofpaper
    Commented Jan 6 at 20:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.