04Mission Tech Act 1

Networking Zero to Hero | Session 4

Ethernet Frames on a Real Wire

Capture complete Ethernet frames, watch a bridge learn sources and prove why broadcast and unknown unicast reach a witness that was never addressed.

Start the labDownload lab runnerPublic lab docs
Time50 to 65 minutes
EnvironmentWSL2 Ubuntu
StackLinux bridge, raw Ethernet, FDB, tcpdump
OutputLocal PCAP plus evidence
00

Read the frame, not just the packet

Build one bridge and three endpoints, then prove unicast, broadcast and unknown-unicast behavior from a witness port.

Tool

Use the frame visualizer to predict encapsulation.

Kernel

Read bridge ports and the forwarding database.

PCAP

Inspect destination MAC, source MAC and EtherType.

01

Predict three forwarding outcomes

BroadcastEvery forwarding port
Known unicastOne learned port
Unknown unicastFlood except ingress
02

Build the pure Layer 2 segment

All traffic remains inside three endpoint namespaces and one Linux bridge.

Ubuntu
chmod +x mission-act1-labs.sh
sudo ./mission-act1-labs.sh lab04 doctor
sudo ./mission-act1-labs.sh lab04 build
sudo ./mission-act1-labs.sh lab04 verify
03

Capture from the witness

The witness is not the destination. Seeing a frame there proves flooding.

Capture
sudo ./mission-act1-labs.sh lab04 capture
sudo tcpdump -nn -e -XX -r results/*-lab04/ethernet-frames.pcap
Packet proofFind the custom EtherType 0x88b5 and payload MISSION-L2-UNKNOWN on the witness capture.
04

Match source learning to the FDB

The bridge learns from source MAC addresses. It uses destination MAC addresses for forwarding.

Kernel evidence
sudo bridge fdb show br mls1-l04-br
sudo bridge link show master mls1-l04-br
05

Explain the envelope

Exit statementPoint to the Ethernet header, name the payload type and explain why a switch does not need to inspect the enclosed ICMP message to forward the frame.
06

Close cleanly

Cleanup
sudo ./mission-act1-labs.sh lab04 destroy