Cabling, Ethernet and Switching

Four twisted pairs carry signals through a typical Ethernet cable. Each receiver reads the difference between two wires. Twisting exposes both wires to similar outside noise, which largely cancels in that comparison. Different twist rates reduce crosstalk, where one pair's signal leaks into another. Attenuation is signal loss with distance; EMI is outside electrical noise from sources such as motors and power cables.

Read the category and shield markings

Cat3, tested to 16 MHz, served older 10 Mbit/s networks and telephone wiring. At 100 m, 5GBASE-T calls for Cat6 or better; an existing Cat5e installation needs assessment before being used at 5 Gbit/s. Cat6's shorter 10 Gbit/s reach also depends on alien crosstalk from neighboring cables. Use Cat6A for a new 100 m, 10 Gbit/s installation.

Shield notation describes the whole cable before the slash and each pair after it. U/UTP has no shielding. F/UTP has foil around all pairs together. S/FTP has an overall braid and foil around individual pairs. Shielded connectors and a bonded patch panel keep the shield continuous; unshielded jacks interrupt that system.

Count the complete channel

The usual office limit is a 100 m channel: up to 90 m of installed permanent link plus 10 m of patch cords in total. A 70 m permanent cable with 3 m and 5 m cords makes 78 m. A 115 m route needs a closer switch location or fiber. Cat8's 25/40 Gbit/s design has a shorter 30 m channel and a 24 m permanent link.

For an 80 m route that must later carry 10 Gbit/s, select Cat6A throughout. Cable, jacks, panel and patch cords all need the rating. One Cat5e jack limits an otherwise Cat6A channel to Cat5e performance at best. A higher category supports lower-speed applications, but adds cost and often bulk.

Use solid conductors for fixed building wiring and stranded conductors for flexible patch cords. Fit plugs designed for that conductor type; a poor contact can work briefly and fail when moved. Ethernet's connector is commonly called RJ45, an 8-position, 8-contact connector. The smaller RJ11 telephone plug does not provide an Ethernet connection.

Recognize other copper links

Coax has a center conductor, dielectric, shield and jacket. RG-6 and RG-59 are 75 Ω cable used for cable-service and video connections; RG-6 commonly uses an F-type screw connector. Legacy 10BASE2 used 50 Ω RG-58 and BNC bayonet connectors. New switched office Ethernet uses twisted pair or fiber. A DAC is twinaxial copper with fitted transceiver ends: an inexpensive, low-power choice for rack links, with passive versions commonly reaching about 5 m.

The jacket also needs the right fire rating. US markings include CMP for plenum spaces, CMR for risers and CM for general use. CMP may replace CMR; the reverse is not allowed. EU installations use CPR Euroclasses such as Eca, Dca, Cca and B2ca, with additional smoke, droplet and acidity ratings. LSZH describes low-smoke, zero-halogen jacket properties; it is not a substitute for the fire class the space requires.

An optical fiber carries light through a glass core surrounded by cladding. The lower refractive index of the cladding keeps guided light in the core by total internal reflection. Coatings, buffers, strength members and the jacket protect the glass. The marking 50/125 describes a 50 µm core and 125 µm cladding, not the cable's outside diameter.

Compare the two fiber families

In multimode fiber, light follows many paths. Different arrival times spread a pulse: modal dispersion. OM1 has a 62.5 µm core; OM2 through OM5 use 50 µm cores. OM3 and OM4 are laser-optimized. OM5 supports wideband applications between 850 and 950 nm. For 10GBASE-SR, OM3 reaches 300 m and OM4 reaches 400 m; OM1 and OM2 reach only a few tens of meters.

Single-mode fiber supports one mode, so it has no modal dispersion. OS1 is mainly used indoors; OS2 is low-loss fiber used for outdoor and longer routes. With suitable optics, 10GBASE-LR reaches 10 km at 1310 nm and 10GBASE-ER reaches 40 km at 1550 nm. Fiber type and optics jointly set reach: single-mode glass alone does not turn an SR module into a long-reach link.

Fiber resists EMI and does not conduct electricity between buildings. This avoids a copper signal path between different ground potentials. Its long reach suits backbones, but installation needs specialist tools and clean connections. Glass can be damaged by pulling or bending, both ends need suitable optics, and the fiber itself cannot supply PoE.

Work through the choices

Two buildings 1.2 km apart need a 10 Gbit/s link. SR optics on OM4 stop at 400 m, so choose single-mode with LR optics. Between racks 70 m apart, OM3 or OM4 with SR optics fits. For switches 2 m apart in one rack, a compatible DAC is often the economical choice. For a 150 m backbone, OM4 supports 10 Gbit/s today, while single-mode gives more room for future changes.

Jacket colors help identify stock: yellow for single-mode, orange for OM1/OM2, aqua for OM3 and often OM4, violet for OM4 in many sites, lime green for OM5. Confirm the printed grade. Match the backbone, patch cords and both optics; mixing 50 µm and 62.5 µm fiber adds loss.

Connect the directions and work safely

A usual duplex link uses two fibers: each transmitter reaches the far receiver. BiDi optics use one fiber and complementary wavelengths. An end transmitting at 1270 nm and receiving at 1330 nm needs a partner transmitting at 1330 nm and receiving at 1270 nm.

Network infrared light is invisible. Never look into a fiber or open optical port; verify that the fiber is dark with an optical power meter before inspecting it, and use a video inspection scope. Wear safety glasses when cutting fiber, collect glass offcuts in a marked container, and keep food and drink away from the work area.

The name of an Ethernet physical standard tells you what kind of link it describes. In 1000BASE-T, 1000 means 1,000 Mbit/s, BASE means baseband signaling and T means twisted pair. The letters describe a physical interface, not the VLAN or IP address used on it.

Match the standard to the medium

S indicates short-wavelength optics; L indicates long wavelength; E indicates extended reach. A final lane count matters too: 40GBASE-SR4 uses four 10 Gbit/s lanes and eight fibers through an MPO connector. An existing Cat5e link needs assessment for 5GBASE-T, and a shorter Cat6 channel needs assessment for 10GBASE-T.

Choose modules that the ports support

A transceiver sends and receives signals. Common pluggable forms are SFP for 1 Gbit/s, SFP+ for 10 Gbit/s, SFP28 for 25 Gbit/s, QSFP+ for 40 Gbit/s and QSFP28 for 100 Gbit/s. The last two use four lanes. The cage and switch must support the module and rate. Many SFP+ ports accept 1 Gbit/s SFPs; a 1 Gbit/s SFP port cannot run a 10 Gbit/s module at full speed.

A supported SFP+ port can accept SR, LR, copper or DAC options, each with a different medium and reach. Check the vendor compatibility list as well as the form factor. A storage-network Fibre Channel SFP can look the same as an Ethernet SFP but carries a different protocol.

For an ordinary duplex optical link, match the Ethernet standard at both ends. SR and LR are both 10 Gbit/s, but SR expects 850 nm multimode and LR expects 1310 nm single-mode. They do not form a compatible pair. BiDi is the special pairing case: its transmit and receive wavelengths must be complementary.

Use power readings to check the path

dBm is absolute optical power relative to 1 mW: 0 dBm is 1 mW, about −3 dBm is 0.5 mW and −10 dBm is 0.1 mW. dB describes a ratio or loss. Subtract path loss in dB from transmit power in dBm to find receive power.

A transmitter sends −2 dBm and the path loses 3.5 dB. The receive power is −5.5 dBm. A receiver sensitive down to −14 dBm has 8.5 dB of margin above that lower limit. Also check its maximum receive power: a long-reach optic on a very short link can overload a receiver and require attenuation.

DOM, also called DDM, reports values such as temperature, voltage and optical transmit/receive power. On supported Cisco equipment, show interfaces transceiver displays them. Low receive power suggests dirt, bends, damage or excessive length. A media converter joins different media at the same Ethernet speed, such as 1000BASE-T copper to 1000BASE-LX fiber. Modern Ethernet links are point-to-point; full duplex lets the two connected devices send at the same time.

Structured cabling gives a building a stable wiring layout. Each work-area outlet runs back to a patch panel in a hierarchical star. Short patch cords then connect panel ports to switch ports. Moving a user changes the patching without disturbing the solid cable inside the building.

Follow the path from provider to desk

The entrance facility holds incoming provider or campus cables and the demarcation point between provider and customer. The MDF, or main equipment room, houses central equipment. IDFs, or floor telecommunications rooms, hold access switches and patch panels closer to users. Backbone cabling connects these rooms and buildings, commonly with fiber. Horizontal cabling connects each IDF panel to work-area outlets.

ANSI/TIA-568, ISO/IEC 11801 and EN 50173 define structured cabling systems. TIA-569 and EN 50174 address pathways and installation. These standards make components and routes predictable for future changes.

Measure routes and size the room

Place IDFs by the cable route, including rises, drops and service loops. A 20.8 m ceiling route plus a 2.0 m rise, 2.6 m drop and 3 m service loop gives a 28.4 m permanent link. A floor plan's straight-line distance does not include these parts. Keep the usual permanent link within 90 m and leave room for patch cords inside the 100 m channel.

A floor with 24 desks and two outlets per desk needs 48 cables and panel ports. Two 24-port panels take 2U; a 48-port access switch serves them. A 12-fiber backbone leaves spare fibers for a second uplink and growth. Put fiber terminations in an enclosure with adapters and splice trays, so patching does not pull on the splices.

Racks use 482.6 mm-wide panels, commonly called 19-inch racks. One rack unit, 1U, is 44.45 mm high; a typical full-height rack is 42U. Plan cable managers and equipment airflow as well as device height. Match switch intake and exhaust to the room's cool and warm sides. Lockable rooms and cabinets protect the equipment and patching.

Protect the installed cable

For four-pair UTP, keep a bend radius of at least four times the cable's outside diameter. A 6 mm cable therefore needs at least a 24 mm radius. Follow the manufacturer's larger bend limits where specified, especially for fiber. Pull ordinary four-pair cable with no more than about 110 N. Avoid kinks and tight plastic ties; hook-and-loop straps hold bundles without crushing them.

Support routes regularly, for example with J-hooks at intervals no greater than 1.5 m. Keep pathways within their permitted fill; about 40% of a conduit's cross-section is a common planning value. Check the pathway and cable instructions for the actual installation. Overfilled routes make pulling harder and can trap heat in powered cable bundles.

Keep data routes away from mains circuits, motors, transformers and lighting ballasts. Cross power at right angles. Separation distances depend on shielding, circuit load and barriers; use the installation tables instead of one distance for every site. Outdoor routes also need cable and pathways rated for moisture and sunlight.

Every cable needs the fire rating required for its space. When a route penetrates a fire-rated wall or floor, restore the barrier with an approved firestop system suitable for that opening and cable load. A neat hole filled with ordinary foam does not establish the required fire rating.

A termination must preserve both the pin connections and the twisted pairs that carry the signals. A cable can have eight continuous conductors and still fail at speed if the wrong wires have been paired.

Follow one wiring scheme

Hold a plug with contacts toward you and its latch away: pin 1 is on the left. The signal pairs occupy pins 1–2, 3–6, 4–5 and 7–8. Pins 3 and 6 form a pair even though the blue pair sits between them. Keeping pairs on adjacent pins 3–4 and 5–6 creates a split pair.

Both schemes have the same performance. Use one consistently across the site and record it. A-to-A and B-to-B cables are straight-through. A-to-B is a crossover, used by older 10/100 Mbit/s equipment to swap transmit and receive pairs. Modern Auto-MDIX handles that swap automatically. A rollover console cable reverses all eight pins and serves a console connection, not an Ethernet link.

Fit a plug step by step

1. Choose a plug compatible with the cable category and solid or stranded conductors. Slide on the boot and cut the cable square.
2. Strip about 25–30 mm of jacket without cutting into conductor insulation.
3. Arrange the colors and untwist only what the plug needs.
4. Trim the wires evenly, roughly 13 mm for a typical plug, while following its design instructions.
5. Push every conductor to the front. Check the color order through the body.
6. Crimp with the matching ratchet tool. The strain relief must grip the jacket.
7. Test the completed cable.

The 13 mm maximum untwist rule protects pair balance near the contact for Cat5e and higher; a connector may require even less. Removing a long section of twists makes alignment easy but increases near-end crosstalk. A continuity beep cannot show that the high-frequency performance is sound.

Seat jacks and panels correctly

Keystone jacks and patch panels use insulation displacement contacts: a metal slot cuts through insulation and grips the conductor. Follow the A or B color labels printed on the jack; their physical layout need not follow pin order. Keep the jacket close, maintain the twists and use the right 110 or LSA punch-down tool. Put the cutting blade on the waste side.

In a shielded installation, preserve foil or drain contact to the connector shield and bond the patch panel correctly. An unshielded jack breaks the shield path. If a conductor is nicked, not fully inserted or in the wrong slot, cut back to sound cable and re-terminate. If the plug grips bare wires instead of jacket, the strain relief cannot protect the connection from a pull.

For coax, use the connector maker's stripping lengths. Expose the center conductor and dielectric, fold back the braid, fit the connector and use the matching compression tool. A braid strand touching the center conductor creates a short; a nicked center conductor can break during handling.

Fiber termination joins glass cores accurately and keeps the mating surfaces clean. A connector's shape tells you how it fits; its polish and fiber type tell you whether the connection is compatible.

Identify connectors and polish

UPC has a slightly domed physical-contact end face; single-mode UPC is commonly blue. APC has an 8° angled face, commonly green, to reduce reflected light. Do not mate APC and UPC. Their faces do not meet properly, creating high loss and possible damage. An adapter joins connector bodies; it cannot correct incompatible polish or fiber types.

Choose a termination method

A pigtail is a short fiber with a factory connector. Fusion splicing welds its bare end to the building fiber with an electric arc, typically losing well under 0.1 dB in a good splice. Mechanical splicing aligns ends in a sleeve with gel and generally has greater loss. Field-installable connectors fit on site; pre-terminated assemblies arrive with connectors already attached.

For a fusion splice, strip to the splicer's required length, clean the bare fiber with a lint-free wipe and isopropyl alcohol, then cleave a flat end at 90°. The machine aligns and fuses the fibers. Check its estimated loss, protect the splice with a heat-shrink sleeve and store it in a tray within the bend limit. Final link testing measures the installed path; the splicer's estimate alone does not certify it.

Use inspect, clean, inspect before mating end faces. A dust particle near a tiny core can block light or scratch both faces. Use approved cleaners and keep caps on unused ports. Follow the optical safety procedure when inspecting fibers.

Make transmit reach receive

On a duplex link, the local transmitter must reach the far receiver. A-to-B polarity crosses those paths. Two transmitters connected together leave both receivers without the expected signal. Correct the duplex pairing at one end, and keep the same polarity method across panels and patch cords. Hybrid patch cords can join an SC panel to LC optics while preserving fiber type, polish and polarity.

Add every source of loss

A loss budget is the permitted attenuation through the path. For a common multimode design at 850 nm, use the specified allowances: 3.5 dB/km of fiber, 0.75 dB per mated connector pair and 0.3 dB per splice. For 300 m with two connector pairs and one splice:

• Fiber: 0.3 km at 3.5 dB/km gives 1.05 dB.
• Connectors: two at 0.75 dB give 1.50 dB.
• Splice: 0.30 dB.
• Total permitted loss: 2.85 dB.

A measured 4.2 dB fails that allowance. Clean and re-inspect, measure again, then locate remaining loss with an OTDR. Also compare the design with the transceivers' optical power budget; passing a generous cabling allowance does not prove the optics have enough margin. On long single-mode links, include attenuation over the full distance. Tight bends cause loss too, especially at 1550 nm.

A finished installation needs records that let another technician find a device, trace its path and judge whether the cable is healthy. Give the same link identifier to the cable, outlet, panel port and test report.

Read physical and logical drawings

Physical diagrams show positions: floor plans, cable routes, panels and rack elevations. Logical diagrams show how devices and networks connect. A layer 1 drawing focuses on ports and cables; layer 2 adds VLANs, trunks and spanning-tree roles; layer 3 shows subnets and gateways. Use consistent symbols and a legend.

At a 1:200 scale, 1 cm on the plan represents 2 m. Route segments of 4.8 cm, 2.1 cm and 3.5 cm total 10.4 cm, or 20.8 m in the building. Add vertical sections and service loops before comparing the route with the permanent-link limit. Measure the route around obstacles, not through walls.

A label such as "2A-B14" can identify floor 2, room A, panel B, port 14. Print it durably at both ends and repeat it in the switch port description. A cable schedule records the outlet, panel port, switch port, VLAN and length. The technical file adds floor and rack diagrams, product information and every test report. Update it to the as-built installation when patching or routes differ from the design.

Choose the copper test that answers the question

Certification measures length, insertion loss, near-end crosstalk, power-sum NEXT, return loss, propagation delay and delay skew as well as wire map. Select the right category and permanent-link or channel test. Permanent-link adapters exclude patch cords; a channel test includes them. Save the report under the link identifier; manufacturers commonly require certification for a system warranty.

An open is a broken or unconnected conductor. A short joins conductors that should be separate. A reversed pair swaps the two wires within one pair; crossed pairs move an entire pair to different pins. A split pair can keep the pin-to-pin map correct while combining wires from different twists. A simple continuity test can miss it; a certifier detects the resulting crosstalk.

A TDR estimates distance to a fault from reflected electrical pulses. "Open at 37 m" helps locate a break along the route. A toner and probe identify an unlabeled cable; they do not certify its data performance. A loopback plug helps test a port.

Test fiber and hand over the records

A visual fault locator provides visible red light for continuity and short-route faults. A light source and optical power meter measure total insertion loss. An OTDR plots backscatter against distance to locate connectors, splices, bends and breaks; a launch cable makes the first connector measurable. An inspection scope checks the end face.

Before handover, match each label to its drawing and saved test result, then check end-to-end service. A device should obtain the intended address and reach its gateway with ping. That operation check complements the cable report: a successful ping does not certify the installed cable category.

A MAC address identifies an interface at layer 2. It has 48 bits, written as 12 hexadecimal digits. The forms "00-1A-2B-3C-4D-5E", "00:1a:2b:3c:4d:5e" and "001a.2b3c.4d5e" name the same address. Separators and letter case do not change its value.

Read one byte at a time

A hexadecimal digit represents four bits, so two digits make one byte. The digits run from 0 through 9 and then A through F. For example, 3C becomes binary 0011 1100. There are $2^{48}$ possible 48-bit patterns, or 281,474,976,710,656.

A universally administered address commonly begins with a 24-bit OUI, an organizationally unique identifier registered with IEEE. The organization assigns the remaining 24 bits, giving 16,777,216 combinations within that block. The interface maker may differ from the computer brand. A software-assigned local address does not reliably reveal the maker.

Classify the first byte

The two lowest bits of the first byte carry separate meanings:

Read these from the right of the written binary byte. For 02-50-F2-11-22-33, 02 is 0000 0010. The rightmost bit is 0, so the address is unicast. The next bit is 1, so it is locally administered. A unicast first byte whose second hex digit is 2, 6, A or E has that local bit set.

For 01-00-5E-00-00-FB, 01 ends in 01, so it is a group address used for IPv4 multicast. IPv6 multicast commonly begins 33-33; spanning-tree BPDUs use a reserved group address such as 01-80-C2-00-00-00. FF-FF-FF-FF-FF-FF is the broadcast address for all devices in the broadcast domain. Check for that all-ones pattern before calling a group address multicast.

For 3C-22-FB-7A-10-05, 3C ends in 00. It is universally administered unicast, with 3C-22-FB as its OUI in the usual 24-bit allocation format.

Keep local delivery separate from routed delivery

A host sending to another local host uses that host's MAC address. To reach a remote network, it puts the packet into a frame addressed to the local gateway. A router removes the incoming link header and builds a new one for its next link. The packet's source and destination IP addresses normally stay the same when address translation is absent; its Ethernet source and destination addresses change at each routed hop. IPv4 uses ARP and IPv6 uses Neighbor Discovery to find a local neighbor's link address.

A burned-in address is the address stored in the interface hardware, but an operating system or hypervisor can substitute another. Private Wi-Fi addresses and many virtual-machine addresses are locally administered. This also means a MAC address is not a strong identity credential: an attacker can spoof it.

On Windows, ipconfig /all shows the "Physical Address". Linux uses ip link; macOS network settings or ifconfig show interface addresses. A switch's show mac address-table shows where it has learned them.

An Ethernet II frame surrounds a layer 3 packet with a header and a trailer. Its fields let a switch find the destination and a receiver identify the payload and detect damage.

Read the fields in transmission order

EtherTypes include 0x0800 for IPv4, 0x86DD for IPv6 and 0x0806 for ARP. Values of at least 0x0600 identify EtherTypes. A value of 1,500 or less instead identifies a length in an IEEE 802.3 frame, followed by an LLC header; standard spanning-tree BPDUs use that style.

Separate payload size from frame size

Count an untagged frame from destination MAC through FCS. Its header and trailer total 18 bytes. With 46 bytes of payload and padding, the minimum is 64 bytes. With 1,500 payload bytes, the maximum is 1,518 bytes. A 28-byte ARP message needs 18 bytes of padding to reach the 46-byte minimum data field.

The MTU is the largest layer 3 packet carried as payload, normally 1,500 bytes on Ethernet. It excludes the Ethernet header and FCS. An 802.1Q tag inserts four bytes after the source MAC, so a full tagged frame is 1,522 bytes while its IP MTU remains 1,500.

The tag contains the 0x8100 tag identifier, a 3-bit priority value from 0 to 7, one drop-eligible bit and a 12-bit VLAN ID. Changing a tag changes the checked frame, so the switch recalculates its FCS.

Jumbo frames raise the supported payload, often to about 9,000 bytes. The exact setting depends on the platform. Every device and link must support the size actually sent; a larger maximum still permits small frames. A jumbo-capable host behind a smaller-limit switch can lose large transfers while small pings succeed. Oversize IP packets also encounter the next link's MTU when routed; fragmentation is subject to the IP version and packet flags.

Allow for time outside the frame

A full untagged frame uses 1,518 bytes plus 8 bytes of preamble/delimiter and a 12-byte-time interframe gap. That is 1,538 byte-times for 1,500 payload bytes, about 97.5% payload efficiency. Minimum frames use 84 byte-times, or 672 bit-times, including the same overhead. At 1 Gbit/s, the theoretical maximum is about 1,488,095 minimum frames per second.

Interpret error counters

The sender computes a CRC-32 frame check sequence over the frame from destination MAC through payload and pad. The receiver checks it and discards a frame that fails. Ethernet does not retransmit it; recovery may happen at a higher layer such as TCP.

A runt is shorter than 64 bytes. A giant exceeds the size permitted by the receiving interface; its exact counter threshold depends on tag and jumbo support. A CRC error means the FCS failed. Rising errors call for checks of cable damage, termination, optical cleanliness, interference and duplex settings. A frame's valid size alone does not prove its contents arrived intact.

A layer 2 switch keeps a MAC address table, also called a CAM table. Each entry joins a MAC address and VLAN to a port. The VLAN matters: forwarding happens inside that layer 2 network.

Apply two separate decisions

First, the switch learns the source address on the incoming port and VLAN, refreshing an existing entry or adding one. Then it looks up the destination to decide where the frame goes.

Flooding uses eligible forwarding ports. A blocked port or a trunk that does not carry the VLAN cannot provide an outgoing path.

Follow a first exchange

An empty switch has PC-A on port 1 and PC-C on port 3. All four ports belong to the same VLAN and are forwarding. A sends to C. The switch learns A on port 1, but has no C entry, so it sends copies to ports 2, 3 and 4. The destination address remains C in those copies.

C replies. The switch learns C on port 3 and finds A on port 1. Only port 1 receives the reply. If PC-B on port 2 later broadcasts, the switch learns B on port 2 and floods to ports 1, 3 and 4. Learning from the destination would falsely suggest where an interface lives; only arrival provides that evidence.

Dynamic entries age out after inactivity, commonly 300 seconds by default on Cisco switches. A moved laptop is relearned on its new port when it sends. Static entries do not age. Repeated rapid moves between ports, called MAC flapping, can reveal a loop. When a destination has no learned entry, traffic to it is flooded, including when capacity prevents learning more addresses.

Use show mac address-table to inspect VLAN, address, type and port. To find one interface, use show mac address-table address 001a.2b3c.4d5e. clear mac address-table dynamic removes dynamic entries; the switch then relearns from arriving sources.

Count domains at the right boundary

A hub shares one collision domain among its devices and uses half duplex. Each switch port provides a separate segment; full-duplex point-to-point links have no collisions. A broadcast domain follows the VLAN's connected layer 2 extent. A router separates its routed interfaces even when disconnected switches use the same VLAN number.

For example, one router interface reaches a switch with six PCs and another reaches a separate switch with four PCs. Including the two router uplinks gives 12 Ethernet segments and two broadcast domains. The repeated local VLAN number does not join them through the router.

Store-and-forward receives a complete frame and checks the FCS before sending it onward. Cut-through begins after reading the destination and can pass damage it has not yet detected. Fragment-free waits for the first 64 bytes to avoid most collision fragments. A layer 3 switch adds routing between networks; within a VLAN it still performs MAC-based switching.

A link light proves a physical connection is present, but does not prove the two ends agree on how to use it. Speed, duplex, port state and counters each answer a different question.

Match speed and duplex

Full duplex lets both ends transmit at the same time with no collisions. Half duplex allows one direction at a time and uses CSMA/CD for collisions. Different standards provide full duplex differently: 100BASE-TX uses a pair per direction, 1000BASE-T sends both ways on all four pairs, and ordinary duplex fiber uses one strand per direction.

Leave both ends on autonegotiation to advertise capabilities and select their best common speed and duplex. Gigabit and faster twisted-pair links rely on negotiation. If a 10/100 port negotiates against a fixed-speed partner, it can detect speed but cannot detect the fixed duplex setting; it falls back to half duplex.

A server forced to 100 Mbit/s full duplex can therefore link to an auto switch port running 100/half. Pings may pass, but traffic is slow under load. Late collisions appear on the half-duplex side, while CRC errors and runts can appear at the full-duplex side. Put both on auto, or match both fixed settings for that legacy connection. A fixed speed mismatch instead prevents a usable link.

Read the state before changing settings

A basic Cisco IOS setup ties a port to its outlet:

interface GigabitEthernet0/5
 description Outlet 2A-B14 Accounting PC
 speed auto
 duplex auto
 no shutdown

show interfaces status summarizes ports; show interfaces gives counters. Look for rising CRC errors, runts, giants, late collisions and drops. Compare new readings after traffic so an old counter total does not look like a current fault. After correcting an err-disable cause, shutdown followed by no shutdown can restore the port.

Compare neighbors with the drawing

CDP is Cisco's discovery protocol; LLDP, IEEE 802.1AB, works across vendors. They advertise device identity, port and capabilities to direct neighbors. Their announcements do not travel through the network as a routed service. Typical Cisco defaults are CDP every 60 seconds with a 180-second hold time, and LLDP every 30 seconds with a 120-second hold time. Enable LLDP with lldp run on supported Cisco switches. LLDP-MED can communicate a phone's voice VLAN and power needs.

Use show cdp neighbors detail or show lldp neighbors detail to compare local and remote ports with the cable schedule. If SW2 appears on Gi0/24 but the schedule says Gi0/23, trace the patching and update the incorrect connection or record. Discovery supplies evidence of the actual neighbor, not proof that the documentation is right.

Discovery details can expose internal device information. Disable announcements on untrusted-facing ports with the relevant interface commands, such as no cdp enable, no lldp transmit and no lldp receive.

A VLAN, or virtual LAN, is a logical broadcast domain. Its ports can be spread across switches when connecting links carry that VLAN. Staff, phones, printers and cameras can share switches while their broadcasts stay in separate groups.

Plan VLANs and subnets together

Use a separate IP subnet for each user VLAN in a normal design. Devices in the same VLAN communicate through layer 2 switching. A device reaching a different subnet sends to its default gateway, which routes between VLANs. A VLAN number is a layer 2 identifier; a subnet describes IP addresses. They serve different purposes even when a design matches them one to one.

The 12-bit VLAN field represents 0 through 4,095. IDs 0 and 4,095 are reserved, leaving 1–4,094 for VLAN use. On Cisco switches, normal range is 1–1,005 and extended range is 1,006–4,094. IDs 1,002–1,005 are reserved for legacy media, and VLAN 1 is the default VLAN that cannot be deleted. Move user traffic away from VLAN 1 in a planned business design; put unused ports in an unused parking VLAN and shut them down.

An office could use VLAN 10 STAFF, 20 VOICE, 30 PRINTERS, 40 CAMERAS and 99 MANAGEMENT. Its trunk native VLAN could be unused VLAN 900, with 999 for unused access ports. Create each needed VLAN on every switch that must carry it.

Configure data and voice access

vlan 10
 name STAFF
vlan 20
 name VOICE
interface range GigabitEthernet0/1 - 12
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20

A data access port assigns untagged endpoint frames to one data VLAN. In this example a PC's untagged traffic enters VLAN 10. An IP phone with a PC connected through it tags its voice traffic for VLAN 20. The phone can learn that voice VLAN through CDP or LLDP-MED. The phone's two traffic types explain why a voice-enabled access port can handle tagged voice alongside untagged data.

Use show vlan brief to see VLANs and access-port membership. Trunk ports are not shown as access members there. show interfaces GigabitEthernet0/3 switchport shows the port's administrative and operational mode, data VLAN and voice VLAN. On many Cisco switches, normal-range VLAN information persists in a separate VLAN database, so erasing startup configuration alone does not remove it.

Provide a gateway between VLANs

A router-on-a-stick uses one trunk to a router with a subinterface per VLAN. For example, subinterface g0/0.10 identifies VLAN 10 with encapsulation dot1Q 10 and has that VLAN's gateway address.

A layer 3 switch can use a switched virtual interface, or SVI, per VLAN:

interface vlan 10
 ip address 10.1.10.1 255.255.255.0
 no shutdown

The switch also needs ip routing to route between its VLAN interfaces. An SVI on a layer 2 switch can provide remote management without turning the switch into a router. VLAN separation controls layer 2 reach, but routing can permit traffic between the groups; access control rules are needed when that routed traffic must be restricted.

An 802.1Q trunk carries several VLANs over one connection. The receiver uses a four-byte tag to keep their frames separate. Trunks can connect switches, a routing device, a virtualization host or an access point that serves several networks.

Follow the tag and the native VLAN

A switch inserts the tag after the source MAC address. It includes a 12-bit VLAN ID and causes a new FCS calculation. On the usual trunk configuration, traffic for the native VLAN crosses untagged, and incoming untagged traffic is assigned to that native VLAN. Cisco's default native VLAN is 1.

Both ends must agree on the native VLAN. If one end uses 10 and the other 20, an untagged frame can leave VLAN 10 and enter VLAN 20. CDP may report a mismatch, and spanning tree may block the inconsistent path. Choose the same unused native VLAN at both ends; native-VLAN tagging is another supported design option.

Configure the intended VLANs explicitly

interface GigabitEthernet0/24
 switchport mode trunk
 switchport trunk native vlan 900
 switchport trunk allowed vlan 10,20,30,40,99
 switchport nonegotiate

On older platforms with several encapsulation choices, select switchport trunk encapsulation dot1q first. Switches that only support 802.1Q do not need that command. Apply matching intended settings to the far end.

The allowed-list syntax matters. switchport trunk allowed vlan 50 replaces the list with VLAN 50. switchport trunk allowed vlan add 50 retains the existing list and adds 50. A one-word difference can stop every existing user VLAN on an otherwise healthy link.

Cisco DTP negotiates trunking when supported. Dynamic desirable actively requests a trunk; dynamic auto waits. Desirable with auto forms a trunk, while auto with auto stays access. Static access or trunk mode makes the intended role explicit. switchport nonegotiate stops DTP messages for a manually configured connection.

Trace a broadcast across switches

A PC sends an untagged broadcast into a VLAN 10 access port on SW1. SW1 places it in VLAN 10. It sends untagged copies to eligible VLAN 10 access ports and a tagged VLAN 10 copy along a trunk whose native VLAN is 900. SW2 reads the tag, keeps the frame in VLAN 10 and removes the tag when sending it to a VLAN 10 access device. VLAN 20 devices receive no copy. Another trunk carries the VLAN 10 tag too, unless that trunk makes VLAN 10 native.

Read all three trunk status lists

show interfaces trunk shows operational trunks, native VLANs and three progressively narrower lists:

1. VLANs allowed by configuration.
2. Allowed VLANs that are active locally because they exist on the switch.
3. VLANs forwarding in spanning tree and not pruned.

A number in the first list alone does not establish a working path. An access port connected to a trunk does not carry all its VLANs; it can accidentally join the access VLAN to the trunk's native VLAN.

A VLAN fault is easier to find when each check follows the actual frame path. Begin at the affected host's access port and move toward the destination. An up trunk proves only that the link is trunking; it does not prove that the required VLAN crosses it.

Check one condition at a time

1. Confirm the access VLAN with show interfaces ... switchport and show vlan brief.
2. Confirm that the VLAN exists on every switch along the path.
3. Use show interfaces trunk to confirm operational trunking.
4. Check the allowed VLAN list at each end and matching native VLAN settings.
5. Check spanning tree for that VLAN; the selected path must be forwarding.
6. For a different destination VLAN, check the host gateway and the router subinterface or SVI.

Write down the path and the result at each switch. This keeps a working physical link from distracting you from a missing logical condition.

Separate three common trunk faults

PC-A and PC-B use VLAN 10 on different switches. SW2's trunk allows only 20 and 30 because its list was replaced. The link stays up, and those other VLANs can work. On SW2's trunk, switchport trunk allowed vlan add 10 restores VLAN 10 while preserving the others. Verify the final list and test again.

A newly connected pair of switches has both ports in dynamic auto. Neither requests trunking, so the link stays access in VLAN 1. Set both intended uplinks to switchport mode trunk, configure matching native and allowed VLANs, and disable DTP. Changing the host's IP address will not make an access link carry several VLANs.

New IP phones have voice VLAN 20 on their access ports, but the upstream switch has no VLAN 20. Its trunk may allow 20 while omitting it from the allowed-and-active list. Create the VLAN upstream, then check that it reaches the forwarding list. An allowed number does not create a local VLAN.

Use symptoms to choose the next check

A host receiving an address from an unexpected subnet suggests wrong access-VLAN membership. Hosts working on one switch but failing across the uplink suggest a missing VLAN, an allowed-list omission or a nonforwarding path. A native-VLAN mismatch message points to different untagged classifications at the two ends. Verify the configuration before changing it; a symptom suggests a cause but does not prove it alone.

If same-VLAN communication works and only cross-VLAN communication fails, inspect the default gateway. On a layer 3 switch, use show ip interface brief to check its SVI. In the usual SVI autostate behavior, the VLAN must exist, the SVI must be enabled, and at least one port carrying the VLAN must be up and forwarding. Inter-VLAN routing also needs ip routing and the correct gateway addresses.

After a fix, repeat the failed test and verify the relevant status output. Update the VLAN table, layer 2 diagram, patch schedule and descriptions to reflect the working arrangement. Otherwise the next technician may restore the old fault while following an outdated drawing.

Redundant Ethernet links can create a loop. Frames have no layer 2 hop limit, so broadcasts circulate and multiply. The switch learns one source on alternating ports, causing MAC table instability, and hosts can receive duplicate frames. Spanning Tree Protocol, or STP, leaves a connected, loop-free set of forwarding paths and keeps other paths available as backups.

Elect the root, then choose ports

Switches exchange BPDUs, bridge protocol data units, carrying root identity, path cost, sender identity and port information. The lowest bridge ID wins the root election: compare priority first, then MAC address. Cisco priorities start at 32,768 by default and change in steps of 4,096, from 0 to 61,440. The per-VLAN extended system ID adds the VLAN number, so VLAN 10's default displayed value is 32,778.

Each nonroot switch selects one root port with the lowest total cost toward the root. If paths tie, compare the upstream bridge ID, then upstream port priority and port number. On each segment, the switch advertising the better path has the designated port. Ties use bridge ID. Other redundant ports block user traffic. In a normal connected tree, the root's active participating ports are designated.

Add the costs of ports facing the root along the candidate path. Use the same cost method throughout the design.

Work through a triangle

SW1, SW2 and SW3 have equal priorities; SW1 has the lowest MAC address, so it is root. SW1–SW2 and SW2–SW3 run at 1 Gbit/s, short cost 4 each. SW1–SW3 runs at 100 Mbit/s, cost 19.

SW2's root port faces SW1 with cost 4. SW3 compares its direct cost 19 with $4+4$ through SW2, giving cost 8. Its root port therefore faces SW2. SW1's end of the slow direct link is designated; SW3's end blocks. The two-hop route wins because cost, not hop count, controls the choice.

Choose the root deliberately with spanning-tree vlan 10,20 root primary on the intended core switch and root secondary on the backup. Typical resulting priorities are 24,576 and 28,672; the primary macro can choose lower to beat an existing root. An explicit command such as spanning-tree vlan 10 priority 4096 sets the priority directly. Verify with show spanning-tree vlan 10.

Recognize waiting and backup behavior

Classic states are blocking, listening, learning, forwarding and disabled. Listening and learning each normally last 15 seconds. Learning builds the MAC table but does not forward user frames. Hello time is 2 seconds and max age is 20 seconds; an indirect failure can take about 50 seconds to recover after aging plus both delays. A blocked port remains physically up and receives BPDUs.

PVST+ creates a tree per VLAN, so VLANs can use different roots and uplinks. It does not share a single VLAN's traffic across parallel forwarding paths. MSTP groups multiple VLANs into a smaller set of instances. Aggregation provides another way to use parallel links together.

RSTP, the rapid form of spanning tree, changes paths without depending on the full classic listening and learning delays on suitable links. Cisco Rapid PVST+ runs a rapid tree for each VLAN. Enable it with spanning-tree mode rapid-pvst and verify that show spanning-tree reports protocol rstp.

Separate a port's role from its state

A root port gives a nonroot switch its preferred path to the root. A designated port forwards toward a segment. An alternate is a spare path to the root. A backup is a spare for a designated port on the same shared segment, typically a hub arrangement. A disabled port does not participate.

The three rapid states are discarding, learning and forwarding. A role says what the port contributes to the topology; a state says what it currently does with traffic. Cisco output can show Root, Desg, Altn and Back for roles, and FWD, LRN or BLK for states; BLK represents discarding in rapid operation.

Full-duplex point-to-point neighbors use a proposal/agreement handshake to establish safe forwarding quickly. An alternate can take over as root port when its active path fails. Shared half-duplex segments limit rapid operation. Each bridge sends BPDUs at hello intervals, and three missed 2-second hellos indicate a lost neighbor after 6 seconds when there is no earlier physical failure signal.

Treat end-device ports as edges

PortFast makes an end-device port an edge port, forwarding immediately and avoiding topology-change events when that endpoint restarts. Configure spanning-tree portfast on an access interface, or use spanning-tree portfast default for access ports globally. Use the trunk form only for intended end systems such as virtualization hosts. Switch-to-switch links need normal spanning-tree participation.

Add BPDU guard to a desk port with spanning-tree bpduguard enable. Any received BPDU places it in err-disabled state. The global spanning-tree portfast bpduguard default applies this protection to operational PortFast ports. If a user plugs in a bridging device that sends or passes BPDUs, the port shuts down. Correct the connection before restoring it with shutdown and no shutdown.

Match the guard to the risk

Root guard prevents a downstream switch from taking over as root through that port. Loop guard prevents a port from assuming it can forward when a one-way fault has silenced expected BPDUs. Their triggers differ: root guard objects to a better root advertisement; loop guard objects to missing control information.

BPDU filter suppresses BPDUs. Globally configured PortFast filtering falls back to normal STP when a BPDU arrives. Interface-level spanning-tree bpdufilter enable suppresses sending and processing on that interface and can permit a loop. It is not a replacement for BPDU guard. Guard placement protects the topology; bridge priorities still choose the intended root.

Link aggregation combines physical links into a logical connection. Cisco calls it an EtherChannel or port channel; other systems use LAG, bond or team. Spanning tree sees the logical link, so it does not block individual correctly bundled members. If one member fails, remaining members can continue carrying traffic.

Negotiate with a compatible partner

LACP active works with active or passive. Mode on uses no negotiation and must match at both ends; incorrect static arrangements can lose traffic or create loops. LACP is generally the safer choice because it checks for an agreeing partner.

Members need the same speed, duplex and switchport settings. Access members need the same VLAN; trunk members need matching native and allowed VLAN settings. Both endpoints must support the bundle. Members terminate on one logical switch at each end: one chassis, a stack or a supported multichassis system. Two independent switches do not become one partner merely because their ports use the same channel number.

Configure, then inspect the actual members

For two compatible interfaces on each switch:

interface range GigabitEthernet1/0/1 - 2
 channel-group 1 mode active
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99

Set matching intended native VLAN and trunk settings at both ends. Apply shared settings to the port-channel interface so they remain consistent across members. A routed port channel instead uses no switchport and an IP address on the logical interface.

show etherchannel summary might show Po1(SU): S means layer 2 and U means in use. Members marked (P) are bundled. (I) means stand-alone, (s) suspended and (D) down. show lacp neighbor displays the negotiating partner. A physical link that is up but suspended does not add usable bundle capacity. Check matching settings and partner mode before counting its speed.

Platform limits matter. Many Catalyst switches support eight active members and may keep others as standby; other platforms differ. Count active members in the actual output instead of assuming every configured interface contributes.

Predict capacity without overpromising one transfer

Switches normally choose a member with a hash of fields such as source/destination MAC addresses, IP addresses or transport ports. Frames in one flow stay on the same member to preserve order. Four 1 Gbit/s members give up to 4 Gbit/s of aggregate capacity in one direction, but one ordinary flow remains limited by a 1 Gbit/s member.

Several flows can still hash to the same link. A file transfer between two hosts does not automatically spread evenly over all members. Select hash fields that vary in the real traffic; for example, port-channel load-balance src-dst-ip uses IP address pairs. Redundancy and total capacity are separate benefits from the speed of one conversation.

Power over Ethernet carries DC power and Ethernet data over twisted-pair cable. It lets a phone, camera, badge reader or access point use one cable for both. The PSE, power sourcing equipment, is a switch or injector; the PD, powered device, receives the power.

Detect the device before powering it

A standards-based PSE checks for a valid PoE signature and classifies the PD before applying operating power, around 48 V nominal. It does not apply that operating voltage indiscriminately to every connected device. Passive injectors that apply a fixed voltage without IEEE detection can damage incompatible equipment.

The difference allows for cable loss. Compare a device's power need with the power available at the device, while adding the switch's reservations on the PSE side. A higher-type PSE supports lower-type devices; a high-power device on an inadequate port may lose features or fail to start.

Add the reserved power

Classes identify PSE allocations: class 1 is 4 W, class 2 is 7 W, classes 0 and 3 are 15.4 W, class 4 is 30 W, class 5 is 45 W, class 6 is 60 W, class 7 is 75 W and class 8 is 90 W. LLDP or Cisco CDP can communicate a more exact supported request.

A 370 W switch is planned for 12 class-2 phones, eight class-4 cameras and two class-4 access points:

• Phones reserve $12\times 7=84$ W.
• Cameras reserve $8\times 30=240$ W.
• Access points reserve $2\times 30=60$ W.
• Total is 384 W, exceeding 370 W by 14 W.

Even if every port supports 30 W individually, the total is too large. The switch can refuse power according to allocation and priority. Choose more total power, split the devices across PSEs, use suitable injectors, or budget verified negotiated requests where supported. Do not assume a device's low momentary consumption is its permitted maximum.

Check cabling and operating state

Modern PoE installations use Cat5e or better and must also satisfy the Ethernet speed standard. Original Type 1 can use Cat3, while Type 2 and higher require Cat5e or better. The usual 100 m channel limit remains. Higher current heats conductors, especially in large bundles; conductor size, category and installation conditions affect the heat. Cat6A and thicker conductors can help, along with suitable bundle sizes and temperature ratings.

Fiber cannot deliver PoE. A remote fiber-connected device needs local power or a separate copper power path, such as a suitable hybrid assembly. Adding optical reach does not remove that power need.

On Cisco equipment, show power inline shows the total budget, allocated or used power, remaining power and individual port information. power inline auto enables normal PoE behavior; power inline never disables it. For a dark device, check port capability, remaining budget, administrative power setting and cable condition before blaming its Ethernet VLAN.