Watch a switch learn, age out and flood

short · 35 min · Objective 2.2

Task

Build a software switch, watch its MAC address table populate as hosts talk, and force it to flood by clearing an entry. The learning process is a three-sentence definition and a much stickier memory once you have watched the table fill.

Steps

  1. Create the bridge, which is a switch: sudo ip link add br0 type bridge and sudo ip link set br0 up.
  2. Create two namespaces as hosts, each with a veth pair, one end in the namespace and the other attached to the bridge. Give them 10.10.0.1/24 and 10.10.0.2/24.
  3. Look at the table before any traffic: bridge fdb show br br0. You will see the bridge's own addresses and nothing learned.
  4. Generate traffic — sudo ip netns exec h1 ping -c 2 10.10.0.2 — then look again. Both host MACs now appear against their ports. That is learning.
  5. Flush the table with sudo bridge fdb flush dev veth1 and immediately ping again while capturing on the other port. The first frame is flooded to every port because the switch no longer knows where the destination is.

Verify

bridge fdb show br br0 | grep -v permanent
sudo ip netns exec h1 ping -c 2 10.10.0.2
bridge fdb show br br0 | grep -v permanent
bridge link show

The first listing must be empty or nearly so; the second must show a learned entry for each host MAC against its port. That difference is the switch learning, observed rather than described.

Notes

Three behaviours define a switch and you have now seen all of them. It learns source MAC addresses from arriving frames. It forwards a frame whose destination it knows out the single correct port. It floods a frame whose destination it does not know out every port except the one it arrived on.

Ageing is the fourth: entries expire, typically after five minutes, which is why a device that has been quiet gets flooded to again. And that flooding behaviour is exactly what a MAC flooding attack abuses — fill the table and the switch floods everything, which lesson 36 covers.