[HECnet] Apples MAC OS X pcap library...

[Johnny Billquist]

Hi.

Jean-Yves Bernier wrote:
At 11:54 AM +0100 2/16/10, Johnny Billquist wrote:
When a packets is sent from machine B it goes to the switch. The switch
either sees a broadcast packet, and forwards it to all ports, or a
packet for a specific MAC address, and forwards it to the port of
machine A.
Well, I suppose the bridge had announced over the LAN that it is DECNET
nodes such, then machine B "believes" A hosts those nodes, right? So the
bridge has NOT to sniff unicast traffic, because packets are addressed to
it.

Correct, except you don't "announce" anything. The switch will learn by sniffing. Before it knows where a machine is located, unicast packets will go out on all ports, just like broadcasts. But once a machine have sent a single packet, the switch knows that that mac address is on that port, and all packets to that mac address can then specifically be sent to only that port. It works okay even if you move the machine to another port as well, because as soon as a single packet have been sent from the machine at the new port, the switch relearns.