A junior technician at a cooperative's NOC sees an access switch send a frame out every port for an unknown destination MAC address, and separately sees a subscriber's DHCP discover frame also go out every port. The technician assumes these are the same behavior. Why are they actually different?
Select an answer to reveal the explanation.
Short Explanation
They look the same on the wire — traffic going out every port — but the reason is completely different underneath. One is the switch guessing because it doesn't know where the destination lives; the other is a frame that was addressed to everyone from the start and was never going to get a single-port answer.
Full Explanation
Flooding an unknown unicast frame and forwarding a broadcast frame both result in traffic going out every port in a broadcast domain, but the cause is different in each case: flooding happens specifically because the destination MAC address isn't currently in the switch's MAC address table, so the switch falls back to sending the frame everywhere to make sure it reaches its target; a broadcast frame, like a DHCP discover, is explicitly addressed to the broadcast MAC address from the moment it's sent, so it is always flooded to every port in the domain regardless of what the MAC table contains. Attributing both to a full MAC table is incorrect — a DHCP discover is broadcast by design (the client has no server address yet to unicast to), and that has nothing to do with table capacity, while unknown-unicast flooding, as covered elsewhere, is usually a normal aging event rather than a capacity problem. Claiming flooding only involves multicast and broadcasting only involves unicast inverts the actual relationship; the unknown-unicast case involves a unicast destination address that simply isn't yet known, not multicast, and DHCP discover broadcasts are not unicast at all. Saying routers trigger flooding while only switches trigger broadcasting misattributes both behaviors, since both are switch-level Layer 2 forwarding decisions and neither depends on a router being present. An operational check that distinguishes the two is inspecting the destination MAC address in each frame: an all-ones broadcast address explains guaranteed flooding by design, while a specific-but-unlearned unicast address explains flooding as a lookup miss.