Don't Panic — Switching

Switching is the part of a local network that decides where an Ethernet frame goes. It learns which MAC address arrived on which port, then forwards a known destination to one port instead of telling the whole building. This is progress over a hub, which had the social boundaries of a megaphone.

The useful picture is a table: MAC address on the left, switch port on the right. A frame supplies a source address, so the switch learns. A destination either matches the table and gets one precise exit, or does not and gets flooded while the switch waits to learn better manners. Broadcast traffic is always flooded, which is why a large flat LAN becomes an unwanted group conversation.

A VLAN is the fence in that conversation. It makes one physical switch carry separate broadcast domains. An access port belongs to one VLAN for an endpoint; a trunk carries several VLANs between switches with 802.1Q tags. The sharp edge is the native VLAN: its frames travel untagged, so two trunk ends that disagree can put traffic in a place neither design intended.

Redundant links are where the furniture develops opinions. Two paths are good for survival, but at layer 2 they can let flooded frames circle forever. Spanning Tree Protocol picks a root bridge and blocks enough redundant ports to form one forwarding tree. The idle link is not broken; it is waiting for a failure. Link aggregation is different: it turns parallel members into one logical link, while a hash keeps each flow on one member.

Read the intro for the full forwarding path and the security controls that protect it. The slides make topology and STP decisions visible at a glance. Use the cheatsheet when a port role, VLAN rule, or mitigation needs a quick answer. The practice reference is the operational checklist for checking that the network you meant to build is the one currently forwarding frames.