Ethernet Switching

Ethernet switching operates at Layer 2 of the network stack. A switch receives an Ethernet frame, learns the source MAC address on the ingress port, and looks up the destination MAC address in its forwarding database, commonly called a MAC address table. Entries are normally associated with a VLAN and age out after inactivity. For a known unicast destination, the switch forwards the frame through the appropriate port, or filters it if the destination is reachable through the ingress port.

When the destination MAC address is unknown, a traditional switch floods the frame through other forwarding ports in the same VLAN. Broadcast frames are also flooded within that VLAN. Multicast forwarding depends on configuration and capabilities such as multicast snooping. This behavior makes broadcast-domain size operationally important: large domains increase broadcast exposure and the potential impact of loops or misbehaving endpoints.

VLANs divide switching infrastructure into separate Layer 2 broadcast domains. An access port typically carries one VLAN without an endpoint-visible tag, while a trunk carries multiple VLANs using IEEE 802.1Q tags. VLAN identifiers must match the intended configuration across the connection. A VLAN is not an IP subnet, although assigning one IP subnet to each VLAN is a common design. VLAN separation also does not replace firewall policy or provide encryption.

Switching and routing solve different problems. Consider a host at 192.168.10.20/24 sending traffic to 192.168.20.30. Because the destination is outside its local subnet, the host resolves its default gateway's MAC address using ARP and sends the frame to that gateway. The IP packet still identifies 192.168.20.30 as its destination. The router selects an IP route and creates the appropriate link-layer encapsulation for the next hop. IPv6 uses Neighbor Discovery rather than ARP for neighbor resolution.

Cloud networks often expose Ethernet-compatible interfaces without providing a conventional, customer-controlled Ethernet switch fabric. In Amazon VPC, an instance interface has a MAC address, but the subnet is not a traditional Ethernet broadcast domain. VPC does not support general Ethernet broadcast or arbitrary Layer 2 adjacency. Do not assume that broadcast discovery, spanning tree, or an application requiring transparent Ethernet bridging will work merely because instances share a subnet.

AWS Direct Connect illustrates the boundary between Layer 2 connectivity and Layer 3 cloud access. Its Ethernet connection uses 802.1Q VLAN tagging to distinguish virtual interfaces, while BGP exchanges IP routes over those interfaces. For example, an engineer configuring a private virtual interface must align the VLAN configuration, BGP peer addressing, and autonomous system settings with the intended connection. The VLAN carries the peering traffic; it does not extend an on-premises broadcast domain into a VPC. Reaching workload subnets also requires correct route propagation or route-table entries and appropriate security policy.

Traditional switched networks need loop prevention because Ethernet frames lack an IP-style hop limit. Spanning Tree Protocol can block redundant paths, while supported link aggregation combines physical links into a logical connection. Layer 2 extension can preserve addressing for legacy workloads, but it enlarges failure domains and complicates troubleshooting; routed boundaries generally provide clearer isolation. When diagnosing hybrid connectivity, verify physical link state, VLAN tagging, MAC learning, and MTU before investigating IP addressing, gateway reachability, BGP, routes, and filtering. A healthy Ethernet link alone does not establish end-to-end IP connectivity.