Media Access Control address (MAC address)

MAC Address is the component of Ethernet frame/header.

• MAC Addresses are unique 48-bits hardware number of a computer, which is embedded into a network card (known as a Network Interface Card) during the time of manufacturing. 
• MAC Address is also known as the Physical Address of a network device. 
• In IEEE 802 standard, Data Link Layer is divided into two sublayers –

Logical Link Control (LLC) Sublayer
Media Access Control (MAC) Sublayer

• MAC address is used by the Media Access Control (MAC) sublayer of the Data-Link Layer. 
• MAC Address is worldwide unique since millions of network devices exist and we need to uniquely identify each.

Format of MAC Address

MAC Address is a 12-digit hexadecimal number (6-Byte binary number), which is mostly represented by Colon-Hexadecimal notation.

• The First 6-digits (say 00:40:96) of MAC Address identifies the manufacturer, called OUI (Organizational Unique Identifier).
• The rightmost six digits represent Network Interface Controller, which is assigned by the manufacturer.

Note – LAN technologies like Token Ring, and Ethernet use MAC Addresses as their Physical address but there are some networks (AppleTalk) that do not use MAC addresses.

Types of MAC Address:

• Unicast: A Unicast addressed frame is only sent out to the interface leading to a specific NIC. If the LSB (least significant bit) of the first octet of an address is set to zero, the frame is meant to reach only one receiving NIC. MAC Address of source machine is always Unicast.
• Multicast: The multicast address allows the source to send a frame to a group of devices. In Layer-2 (Ethernet) Multicast address, LSB (least significant bit) of the first octet of an address is set to one. IEEE has allocated the address block 01-80-C2-xx-xx-xx (01-80-C2-00-00-00 to 01-80-C2-FF-FF-FF) for group addresses for use by standard protocols.
• Broadcast: Similar to Network Layer, Broadcast is also possible on the underlying layer (Data Link Layer). Ethernet frames with ones in all bits of the destination address (FF-FF-FF-FF-FF-FF) are referred to as the broadcast addresses. Frames that are destined with MAC address FF-FF-FF-FF-FF-FF will reach every computer belonging to that LAN segment.

What is MAC Cloning?

• Some ISPs use MAC addresses in order to assign an IP address to the gateway device.
• When a device connects to the ISP, the DHCP server records the MAC address and then assigns an IP address.
• Now the system will be identified through the MAC address.
• When the device gets disconnected, it loses the IP address.
• If the user wants to reconnect, the DHCP server checks if the device is connected before. If so, then the server tries to assign the same IP address (in case the lease period has not expired).
• In case user changed the router, the user has to inform the ISP about new MAC address because the new MAC address is unknown to ISP, so the connection cannot be established.
• Or the other option is Cloning, user can simply clone the registered MAC address with ISP.
• Now router keeps reporting the old MAC addresses to ISP and there will be no connection issue.

MAC Address Table

• When any Ethernet frame come to switch, it checks the destination MAC and search it in the MAC address table.
• A MAC address table, sometimes called a Content Addressable Memory (CAM) table, is used on Ethernet switches to determine where to forward traffic on a LAN.
• Now let's break this down a little bit to understand how the MAC address table is built and used by an Ethernet switch to help traffic move along the path to its destination.

The switch made a forwarding decision based on the destination host’s hardware address. The switch essentially forwarded the frame from one port’s ingress queue to another port’s egress queue. To perform this forwarding decision, a switch consults its hardware address table. For Ethernet switches, this is referred to as the MAC address table, or the Layer-2 forwarding table.

1. When a switch is first powered on, the MAC address table will be empty.
2. The switch will build the table through a dynamic learning process, by observing the source MAC address of frames
3. Initially, the switch will have no knowledge of the MAC addresses of HostA and HostB.
4. When HostA sends a frame to HostB, the switch will add HostA’s MAC address to its table, associating it with port ethernet1.
5. The switch will not learn HostB’s MAC address until HostB sends a frame back to HostA, or to any other host connected to the switch.
6. HostB’s MAC address will then be associated with port ethernet2.

Remember: a switch will only add MAC address table entries based on the source MAC address in a frame.

• The MAC address table is stored in fast volatile memory, allowing lookups to be performed very quickly. However, this also results in dynamically learned MAC addresses being lost if the switch is rebooted or powered off.
• Stale (or idle) entries in the table will be aged out. By default, on Cisco switches, idle entries will be purged after 300 seconds.
• Most switches support statically configuring MAC addresses into the table, which will survive a reboot or power failure, and never be purged. Statically configuring entries in the table is only required in limited circumstances.

Ternary Content Address Memory (TCAM)

Today’s networking hardware operates a Layer 2, Layer 3 and Layer 4 of the OSI model. The device might switch Ethernet frames, route IP packets, and implement filters based on the TCP segments. A MAC Address is always an exact match and uses Binary CAM but matching an IP Route or Access List requires partial matching. An IP Packet would have a specific destination IP address of 10.0.0.1 but the route is for 10.0.0.0/24.

A Ternary CAM (TCAM) stores 0, 1, and “don’t care”. The “Don’t Care” at an additional cost over binary CAM since the internal memory cell must now encode three possible states. This is usually implemented by adding a mask bit (“care” or “don’t care” bit) to every memory cell.

Each TCAM entry consist of three components: Value, Mask and Result. Both the value and mask fields are 134 bits in length, but it does not necessarily mean that all 134 bits will be actively used. The actual bit utilization depends on the type of ACL being implemented.
As below their are two types of TCAM entry:

Now, how TCAM is implemented. It mostly depends upon types of switches, i.e., Lower-end switches and High-end switches.
In both Lower-end switches and High-end switches, the component or hardware piece which does the lookup is called the forwarding engine.

• In Lower-end switch, you have one chunk of memory that hold the TCAM memory, and when switch powered on, that one TCAM memory is subdivided into different components, as L2 entries, L3 entries, QOS policies, Security policies. 
• Now, when the frame come in, forwarding engine is smart enough to extract that pieces and feed to TCAM memory for lookup. 
• For e.g., Forwarding engine know to extract the mac address and feed to the L2 entries portion of TCAM memory, forwarding engine know to extract the L3 IP address and feed to the L3 portion of TCAM memory.
• Now TCAM memory will respond the forwarding engine with lookup result, and now switch will decide based on the result whether to rewrite, process, forward or drop. 
• In short, the forwarding engine does lookup in one single chunk of TCAM memory.

Now, in higher-end switches, all above same process is followed, but now the TCAM memory have different or dedicated memory for each portion.
Now, what is the mechanism that determines TCAM space and usage in lower-end switches?
Here the answer, it is “Switching Database Manager” or SDM.

So, in lower-end switches, as we have single chunk of TCAM memory, so the SDM will look at a SDM templates for the portion in TCAM memory.

SDM (Switching Database Manager) is used on Cisco Catalyst switches to manage the memory usage of the TCAM. For example, a switch that is only used for switching won’t require any memory to store IPv4 routing information. On the other hand, a switch that is only used as a router won’t need much memory to store MAC addresses.

• Utilizes pre-formatted “SDM Templates”
• Templates cannot be modified
• One can switch to a different template
• Different templates only activated after a reload

SDM offers several templates that we can use on our switch, here’s an example of a Cisco Catalyst 3560 switch

• Above you can see that the current template is “desktop default” and you can see how much memory it reserves for the different items. Here’s an example of the other templates:
• Here are the SDM templates for this switch. We can change the template with the sdm prefer command: , but it need reload to take effect