Forwarding basics: VLANs, LAG, spanning tree, routing
A transceiver problem never announces itself as a transceiver problem. It appears as a spanning-tree topology change, a LAG member suspended, an OSPF neighbour bouncing, a VXLAN tunnel flapping or "half the users are slow". To read those symptoms back to the physical layer you need the forwarding vocabulary: how a switch learns MAC addresses, what VLANs and trunks are, how link aggregation hashes flows, why spanning tree blocks ports and what routing protocols do when a link blinks. This page is that vocabulary, kept to what matters when the root cause may be a dirty connector.
Layer 2: MAC learning and VLANs
| Concept | What happens | Optics angle |
|---|
| MAC learning | source MAC of each frame is recorded against the ingress port; unknown destinations are flooded | a flapping port flushes and relearns entries — brief floods after every flap |
| Ageing | entries expire (300 s default) | — |
| VLAN (802.1Q) | a broadcast domain; frames carry a 12-bit tag (1–4094) on trunks | — |
| Access port | one untagged VLAN | — |
| Trunk port | many tagged VLANs, one native untagged | native-VLAN mismatch across an uplink shows as partial connectivity, not a link fault |
| MTU / jumbo | 1 500 bytes default, 9 000–9 216 jumbo | MTU mismatch across an uplink passes small packets, drops large — looks like intermittent optics |
| Storm control, BPDU guard, port security | protective features that shut ports | an errdisabled port from any of these looks like a dead module (Symptom index) |
Spanning tree
| Variant | Convergence | Notes |
|---|
| STP (802.1D) | 30–50 s | legacy |
| RSTP (802.1w) | < 1–3 s | default on most |
| MSTP (802.1s) | as RSTP, per instance | VLAN groups |
| PVST+/Rapid-PVST+ | per VLAN | Cisco |
Spanning tree blocks redundant L2 paths. What a bad optic does to it:
- a flapping uplink generates topology change notifications (TCN); each TCN flushes MAC tables network-wide and causes seconds of flooding — users see stalls every flap (Link flapping);
- a unidirectional link (one fibre broken, Tx works, Rx does not) can create a loop if BPDUs stop arriving — UDLD, loop guard and bridge assurance exist for exactly this (No link);
- blocked port LEDs (amber) are normal on redundant links, not a fault (Port naming & LEDs).
Leaf–spine fabrics avoid STP by routing every link.
Link aggregation (LAG, port-channel, bond)
| Item | Rule |
|---|
| Protocol | LACP (802.1AX / 802.3ad): members exchange PDUs, negotiate membership; static LAG has no protection |
| Members | same speed, duplex, MTU; most NOSes require same FEC and media type — 4 × 25G optics or 4 × 25G DAC, not mixed |
| Hashing | flows distributed by hash of MAC/IP/port fields; one flow never exceeds one member's speed |
| Member with errors | LACP keeps it in the bundle while PDUs pass; CRC errors on one member corrupt the flows hashed to it — "some sessions slow, others fine" is the signature (VDM & FEC metrics) |
| Min-links | bundle goes down if fewer than N members are up — protects against running on one degraded link |
| Names | Port-channel, ae, Eth-Trunk, bond, PortChannel per NOS |
| Across two switches | MLAG/vPC/VLT (Stacking & MLAG) |
Practical: when a LAG "works but is slow", check per-member counters and DDM, not the bundle.
Layer 3: routing on the switch
| Concept | What it is | Optics angle |
|---|
| SVI / routed port | IP interface on a VLAN or on a physical port | routed uplinks have no STP; a flap is a routing event |
| Static / OSPF / IS-IS / BGP | routing protocols; DC fabrics use BGP (eBGP per link) or OSPF | neighbour up/down logs pinpoint which link flapped and when |
| ECMP | equal-cost multipath over N uplinks; flows hashed like LAG | one bad uplink degrades 1/N of flows; BFD (50–300 ms) detects failure faster than protocol timers |
| Dampening | suppresses a flapping interface from advertising | a flapping optic ends up dampened — link "up" but traffic not routed |
| VRF | separate routing tables (management VRF!) | pinging the switch over the wrong VRF looks like a link fault |
| First-hop redundancy (HSRP/VRRP) | virtual gateway between two switches | flaps cause gateway switchover |
Overlays
| Overlay | Where | Optics angle |
|---|
| VXLAN / EVPN | DC fabrics: L2 over L3 | tunnels ride ECMP; a failing spine link degrades tunnels randomly, not deterministically |
| MPLS / SR | carrier | fast reroute (< 50 ms) masks flaps — check the underlay counters |
| EVPN multihoming (ESI-LAG) | replaces MLAG | member links to different leaves, same rules as LAG members |
Flow control and lossless classes
| Mechanism | Purpose | Optics angle |
|---|
| 802.3x pause | stop the neighbour | rarely used; global pause hides congestion |
| PFC (802.1Qbb) | per-priority pause for RoCE/FCoE | a link with CRC errors triggers retransmits, not pause — but pause storms from a flapping port can stall a lossless class fabric-wide (Lossless Ethernet) |
| ECN | mark congestion | — |
Reading forwarding symptoms back to the physical layer
| Forwarding symptom | Physical cause to check |
|---|
| STP TCNs every few minutes, MAC flaps in logs | one uplink flapping — DDM Rx power near sensitivity, dirty connector |
| LACP member "suspended" / "individual" | FEC or speed mismatch on that member; module not recognised |
| OSPF/BGP neighbour resets on one link | flapping optic, or module at temperature limit |
| ECMP: a subset of flows slow or lossy | one uplink with FEC uncorrectables / CRC |
| Jumbo frames fail, pings work | MTU — not optics |
| Loop or broadcast storm after a fibre repair | unidirectional link, polarity swap on MPO, missing UDLD |
| Traffic stops after a software upgrade | third-party optics rejected on the new release (Compatibility matrices & firmware) |
| Server sees link up, no traffic | wrong VLAN/native mismatch, or LAG on switch and none on server |
The physical checks behind every row: Symptom index, Verifying optics on a switch.
In CodingBox
Forwarding-layer symptoms point at a port; the port points at a module; the module's DDM, identity and thresholds — read on the switch or on the bench — close the case. Keeping a per-module record in the code database turns "the LAG was slow again" into "member 3, serial X, Rx −17 dBm, replaced".