Network Switch (Network device)
Switch works on data link layer of OSI model (Layer-2). Switch physically similar to the hub and perform the same task of providing single connection platform to peripherals (hosts, servers etc). Switch is the network device replaces the hub by overcoming its problem. Switch is an intelligent device; it can take decision of forwarding frames (unit of data in data link layer) based on MAC address (Hardware address of network interface card) by using switch forwarding database. When the switch is turn on its database is empty, it will take little time to build its switch forwarding database.
Switch forwarding database structure is the relation between port of switch and MAC address of connected device with the port number. When any host on network send data to other computer, sending host is source and receiving host is destination. When switch receives frame from sending host it recognize the port and extract the MAC address from source attribute of the frame header and update its database. In case of destination host address entry is not found in switch forwarding database, switch forward broadcast to the entire devices connected with switch excluding the source. All the devices match its own MAC address with the frame MAC address queried by the switch, if address match device send message back to switch, port is known switch place the MAC entry with the corresponding port on which response is received.
The process of updating switch forwarding database is known as learning. When frame enters the incoming port of the switch, it opens the frame and look for the destination MAC address and match it with the switch forwarding database is the mechanism of filtering. Releasing the frame to specific destination (destination port) is called forwarding.
Switch Hardware Technology
Switch uses hardware based technology ASIC for switching operation. Switch throughput is on higher side, each port on switch work on full capacity mentioned on ports (10 Mbps, 100 Mbps).
Switch Collusion and Broadcast Domains
Switch consists of multiple collusion domains, which eliminate the problem of collusions. Multiple host send data at a time because each port has its own are separate collusion domain but single broadcast domain. Number of collusion domain is always equal to number of ports available on switch. Now days switch operating with the data rate of Giga bits per seconds using physical Ethernet or fiber interface.
Manageable and Unmanageable Switches
Switch can be manageable or non- manageable, manageable switch are expensive have large buffers, robust operating system and web based management console on the other hand unmanageable switches are simply plug and play.
In corporate environment manageable switches are installed to handle the heavy traffic and maximum number of nodes. In manageable switches there are further two categories edge and core switches.
Edge and Core Switches
Edge switches are used to connect the clients with the network and core switches are used to connect server farms and edge switches. Core switches have more fiber ports rather the Ethernet ports.
VLANs in Manageable switches Single broadcast domain is the major drawback of the switch. Broadcast generate because of any protocol, faulty NIC etc received by all connected host which may choke down the network. Manageable switches can use VLAN to eliminate the problem of broadcast by dividing the ports into logical broadcast domain. Broadcast of one VLAN can’t be hear by the other VLANs, it remain restricted within the local VLAN boundaries.
Traffic monitoring on a switched network
Unless port mirroring or other methods such as RMON[ or SMON are implemented in a switch, it is difficult to monitor traffic that is bridged using a switch because all ports are isolated until one transmits data, and even then only the sending and receiving ports can see the traffic. These monitoring features rarely are present on consumer-grade switches.
Two popular methods that are specifically designed to allow a network analyst to monitor traffic are:
• Port mirroring — the switch sends a copy of network packets to a monitoring network connection.
• SMON — “Switch Monitoring” is described by RFC 2613 and is a protocol for controlling facilities such as port mirroring.
Another method to monitor may be to connect a Layer-1 hub between the monitored device and its switch port. This will induce minor delay, but will provide multiple interfaces that can be used to monitor the individual switch port.
Devices attach with the switch can send or receive data within same network, to allow communication between different networks router is used.