Practical Packet Analysis 笔记

charpter 6

p86 交换机根据MAC地址转发数据包

MAC addresses are needed because a switch that interconnects devices  on a network uses a Content Addressable Memory (CAM) table, which lists the MAC addresses of all devices plugged into each of its ports. When the switch  receives traffic destined for a particular MAC address, it uses this table to  
know through which port to send the traffic. If the destination MAC address  is unknown, the transmitting device will first check for the address in its cache;  if it is not there, then it must be resolved through additional communication on the network.

P93 经过一个路由器，路由器减去TTL的值可能大于1

Since the TTL value is technically time-based, a very busy router could decrement the TTL value  
by more than 1, but generally, it’s safe to assume that one routing device will decrement a TTL by only 1 most of the time.