Forwarding basics: VLANs, LAG, spanning tree, routing
Đội ngũ của chúng tôi đang thực hiện bản dịch. Bài viết này tạm thời chưa có bản tiếng Việt và đang được hiển thị bằng tiếng Anh.
A transceiver problem never announces itself as a transceiver problem. It appears as a spanning-tree topology change, a LAG member suspended, an OSPF neighbour bouncing, a VXLAN tunnel flapping or "half the users are slow". To read those symptoms back to the physical layer you need the forwarding vocabulary: how a switch learns MAC addresses, what VLANs and trunks are, how link aggregation hashes flows, why spanning tree blocks ports and what routing protocols do when a link blinks. This page is that vocabulary, kept to what matters when the root cause may be a dirty connector.
Layer 2: MAC learning and VLANs
| Concept | What happens | Optics angle |
|---|---|---|
| MAC learning | source MAC of each frame is recorded against the ingress port; unknown destinations are flooded | a flapping port flushes and relearns entries — brief floods after every flap |
| Ageing | entries expire (300 s default) | — |
| VLAN (802.1Q) | a broadcast domain; frames carry a 12-bit tag (1–4094) on trunks | — |
| Access port | one untagged VLAN | — |
| Trunk port | many tagged VLANs, one native untagged | native-VLAN mismatch across an uplink shows as partial connectivity, not a link fault |
| MTU / jumbo | 1 500 bytes default, 9 000–9 216 jumbo | MTU mismatch across an uplink passes small packets, drops large — looks like intermittent optics |
| Storm control, BPDU guard, port security | protective features that shut ports | an errdisabled port from any of these looks like a dead module (Symptom index) |
Spanning tree
| Variant | Convergence | Notes |
|---|---|---|
| STP (802.1D) | 30–50 s | legacy |
| RSTP (802.1w) | < 1–3 s | default on most |
| MSTP (802.1s) | as RSTP, per instance | VLAN groups |
| PVST+/Rapid-PVST+ | per VLAN | Cisco |
Spanning tree blocks redundant L2 paths. What a bad optic does to it:
- a flapping uplink generates topology change notifications (TCN); each TCN flushes MAC tables network-wide and causes seconds of flooding — users see stalls every flap (Link flapping);
- a unidirectional link (one fibre broken, Tx works, Rx does not) can create a loop if BPDUs stop arriving — UDLD, loop guard and bridge assurance exist for exactly this (No link);
- blocked port LEDs (amber) are normal on redundant links, not a fault (Port naming & LEDs).
Leaf–spine fabrics avoid STP by routing every link.
Link aggregation (LAG, port-channel, bond)
| Item | Rule |
|---|---|
| Protocol | LACP (802.1AX / 802.3ad): members exchange PDUs, negotiate membership; static LAG has no protection |
| Members | same speed, duplex, MTU; most NOSes require same FEC and media type — 4 × 25G optics or 4 × 25G DAC, not mixed |
| Hashing | flows distributed by hash of MAC/IP/port fields; one flow never exceeds one member's speed |
| Member with errors | LACP keeps it in the bundle while PDUs pass; CRC errors on one member corrupt the flows hashed to it — "some sessions slow, others fine" is the signature (VDM & FEC metrics) |
| Min-links | bundle goes down if fewer than N members are up — protects against running on one degraded link |
| Names | Port-channel, ae, Eth-Trunk, bond, PortChannel per NOS |
| Across two switches | MLAG/vPC/VLT (Stacking & MLAG) |
Practical: when a LAG "works but is slow", check per-member counters and DDM, not the bundle.
Layer 3: routing on the switch
| Concept | What it is | Optics angle |
|---|---|---|
| SVI / routed port | IP interface on a VLAN or on a physical port | routed uplinks have no STP; a flap is a routing event |
| Static / OSPF / IS-IS / BGP | routing protocols; DC fabrics use BGP (eBGP per link) or OSPF | neighbour up/down logs pinpoint which link flapped and when |
| ECMP | equal-cost multipath over N uplinks; flows hashed like LAG | one bad uplink degrades 1/N of flows; BFD (50–300 ms) detects failure faster than protocol timers |
| Dampening | suppresses a flapping interface from advertising | a flapping optic ends up dampened — link "up" but traffic not routed |
| VRF | separate routing tables (management VRF!) | pinging the switch over the wrong VRF looks like a link fault |
| First-hop redundancy (HSRP/VRRP) | virtual gateway between two switches | flaps cause gateway switchover |
Overlays
| Overlay | Where | Optics angle |
|---|---|---|
| VXLAN / EVPN | DC fabrics: L2 over L3 | tunnels ride ECMP; a failing spine link degrades tunnels randomly, not deterministically |
| MPLS / SR | carrier | fast reroute (< 50 ms) masks flaps — check the underlay counters |
| EVPN multihoming (ESI-LAG) | replaces MLAG | member links to different leaves, same rules as LAG members |
Flow control and lossless classes
| Mechanism | Purpose | Optics angle |
|---|---|---|
| 802.3x pause | stop the neighbour | rarely used; global pause hides congestion |
| PFC (802.1Qbb) | per-priority pause for RoCE/FCoE | a link with CRC errors triggers retransmits, not pause — but pause storms from a flapping port can stall a lossless class fabric-wide (Lossless Ethernet) |
| ECN | mark congestion | — |
Reading forwarding symptoms back to the physical layer
| Forwarding symptom | Physical cause to check |
|---|---|
| STP TCNs every few minutes, MAC flaps in logs | one uplink flapping — DDM Rx power near sensitivity, dirty connector |
| LACP member "suspended" / "individual" | FEC or speed mismatch on that member; module not recognised |
| OSPF/BGP neighbour resets on one link | flapping optic, or module at temperature limit |
| ECMP: a subset of flows slow or lossy | one uplink with FEC uncorrectables / CRC |
| Jumbo frames fail, pings work | MTU — not optics |
| Loop or broadcast storm after a fibre repair | unidirectional link, polarity swap on MPO, missing UDLD |
| Traffic stops after a software upgrade | third-party optics rejected on the new release (Compatibility matrices & firmware) |
| Server sees link up, no traffic | wrong VLAN/native mismatch, or LAG on switch and none on server |
The physical checks behind every row: Symptom index, Verifying optics on a switch.
In CodingBox
Forwarding-layer symptoms point at a port; the port points at a module; the module's DDM, identity and thresholds — read on the switch or on the bench — close the case. Keeping a per-module record in the code database turns "the LAG was slow again" into "member 3, serial X, Rx −17 dBm, replaced".