Layer 2 Network & ARP Discovery

1

Build the Topology

0/6

⌄

Goal: Place 6 PCs and 2 Cisco 2960 switches. Connect 3 PCs to each switch using straight-through cables, then connect the two switches to each other with a crossover cable.

Add two Cisco 2960 switches to the workspace

Network Devices → Switches → 2960

Add six PCs to the workspace

End Devices → PC

Connect PC1, PC2, PC3 to SW1 using straight-through cables

Copper Straight-Through from the Connections menu

Connect PC4, PC5, PC6 to SW2 using straight-through cables

PC to switch is always straight-through

Connect SW1 to SW2 using a crossover cable

Copper Cross-Over — switch to switch requires crossover (older gear; newer switches auto-detect)

Verify all link lights are green (or amber briefly, then green)

Orange = STP convergence in progress — wait a moment

2

Assign IP Addresses

0/6

⌄

Class rule: We always reserve the first usable host address (.1) for the router. Even with no router present, we skip .1 and begin assigning from .11. Network: 192.168.10.0 /24.

Device	IP Address	Subnet Mask	Default Gateway
Router (reserved)	192.168.10.1	255.255.255.0	—
PC1	192.168.10.11	255.255.255.0	192.168.10.1
PC2	192.168.10.12	255.255.255.0	192.168.10.1
PC3	192.168.10.13	255.255.255.0	192.168.10.1
PC4	192.168.10.14	255.255.255.0	192.168.10.1
PC5	192.168.10.15	255.255.255.0	192.168.10.1
PC6	192.168.10.16	255.255.255.0	192.168.10.1

How to assign: Click a PC → Desktop tab → IP Configuration → select Static → enter the IP address, subnet mask, and default gateway.

Assign static IP to PC1 — 192.168.10.11

Assign static IP to PC2 — 192.168.10.12

Assign static IP to PC3 — 192.168.10.13

Assign static IP to PC4 — 192.168.10.14

Assign static IP to PC5 — 192.168.10.15

Assign static IP to PC6 — 192.168.10.16

3

Test Connectivity & Think It Through

0/3

⌄

Open a PC → Desktop → Command Prompt. Use ping 192.168.10.XX to test connectivity. Start with PCs on the same switch, then try across switches.

Ping from PC1 to PC2 or PC3 (same switch)

Should succeed — record your result

Ping from PC1 to PC4, PC5, or PC6 (other switch)

Did it work? Why or why not?

Ping from PC6 to PC1 (full end-to-end test)

The first ping may time out — this is expected and relates to ARP

💡 Discussion questions — tap to reveal hints

💡 Can we ping a PC on the same switch? Why? ⌄

Yes. Both PCs share the same broadcast domain. The switch forwards frames using MAC addresses — no router is needed to move traffic between ports. Because both devices are in 192.168.10.0/24, IP sees them as local and delivers directly via the switch.

💡 Can we ping a PC on the other switch? Is this one network or two? ⌄

Yes — and it is one single network. The crossover cable between SW1 and SW2 extends the same broadcast domain across both switches. All 6 PCs share 192.168.10.0/24. Without a router to segment traffic, the two switches behave as one larger switch.

💡 Switches are Layer 2 devices — so how can we ping using IP addresses? ⌄

Switches forward frames by MAC address (Layer 2), not IP (Layer 3). But the sending PC uses the IP address to decide where to send traffic. It checks whether the destination is on the same subnet — it is — so it issues an ARP broadcast to discover the destination's MAC. Once it has the MAC, it wraps the ICMP ping in an Ethernet frame. The switch delivers that frame by MAC. IP identifies; MAC delivers.

💡 What is ARP and how does it work? ⌄

ARP (Address Resolution Protocol) maps an IP address to a MAC address. When PC1 pings PC4 for the first time, it broadcasts: "Who has 192.168.10.14? Tell 192.168.10.11." Every device on the network receives this. PC4 recognizes its own IP and sends a unicast ARP Reply with its MAC back to PC1. PC1 stores this IP→MAC mapping in its ARP table and can now address frames directly to PC4. Future pings skip ARP entirely — the answer is cached.

4

Simulation Mode — Watch ARP Live

⌄

Important: Choose a PC you have not yet pinged so the ARP table has no cached entry. This makes the broadcast clearly visible in Simulation mode.

1

Switch to Simulation mode — click the stopwatch icon at the bottom-right of Packet Tracer.

2

In the Event List Filters panel, click Edit Filters. Deselect everything except ARP to remove the noise.

3

Open a Command Prompt on PC1. Type ping 192.168.10.16 (PC6, if not yet pinged) and press Enter.

4

Press Play (or step forward manually). Watch the ARP broadcast envelope leave PC1 and flood every device on both switches.

5

Observe PC6 sending the ARP Reply — a unicast packet traveling only back to PC1, not broadcast.

6

Return to Realtime mode. Ping PC6 again — it responds instantly. No ARP needed; the MAC is now cached.

7

On PC1, open Command Prompt and type arp -a to view the ARP table. Every IP you have pinged should appear with its corresponding MAC address.

8

Bonus: On either switch, go to the CLI tab and type show mac address-table — compare the switch's MAC table to your PC's ARP table. What is the key difference?

What you just witnessed: In real networks this entire ARP exchange happens in microseconds — invisible to users. Simulation mode slows time down so you can see the Layer 2 mechanics that IP depends on.

5

Wrap-Up & Reflection

⌄

💡 Why did the first ping sometimes fail or time out? ⌄

The first ICMP echo is sent while ARP is still resolving the destination MAC. The OS sends the ARP broadcast and starts a timer. If the reply doesn't arrive before the ping times out, the first packet is dropped — perfectly normal behavior. You'll often see "Request timeout for icmp_seq 0" followed by successful replies once ARP completes. Packet Tracer makes this especially noticeable due to processing delay.

💡 What would happen if we added a router between the switches instead of a crossover cable? ⌄

The router would split the network into two separate broadcast domains. ARP broadcasts from SW1 would NOT reach SW2 — routers block broadcasts. You'd need two different IP subnets (e.g., 192.168.10.0/24 and 192.168.20.0/24), and all traffic between them would route through the router. This is the foundation of network segmentation — and how VLANs with Layer 3 routing work at scale.

💡 What is the difference between the switch MAC table and the PC ARP table? ⌄

The switch MAC address table maps MAC addresses to physical ports — it only works at Layer 2 and has no awareness of IP. The PC's ARP table maps IP addresses to MAC addresses — bridging Layer 3 (IP) down to Layer 2 (MAC). The switch knows which port a device is connected to; the PC knows which MAC belongs to which IP. Both tables are needed to get a packet from source to destination.

✓ Lab Complete!