You need a CAM aging timer greater or equal to the ARP timeout in order to prevent unicast flooding. B. TCAM is also a fast cached memory table however it is used primarily for routing table. Next steps. MAC addresses, and switch ports, along with their VLAN information. This flag is re-enabled whenever the switch receives a new packet from the corresponding MAC address, keeping active addresses in the table. mac address of the connected device) and port number. The port of arrival and the VLAN are both recorded in the table, along with a timestamp. In a switched network, each device (e. This command displays the real-time entries of the CAM table. More about CAM over flow: CAM overflow. Here to help. 1(11)EA1, the syntax for CAM table commands used the keywords mac-address-table. Switch then acts as a hub by broadcasting packets to all machines on the network and attackers can sniff the traffic easily. 1. As of STP steps , it learns from which ports a mac-address arrives and populates its CAM TABLE( mac-address/port). The switching table entries are normally dynamically. 0 Helpful Reply. For any matching results, CAM will return the destination port (the associated content). And the network might go haywire. A sends packet to X with correct IP source address but incorrect source MAC address. Hello, Would someone be able to clarify a point regarding MAC address table overflow attacks. However, this also results in dynamically- learned MAC addresses being. then what about TCAM, 1. 36d0 vlan 1 interface fastEthernet 0/1. . The mac address table is a table maintained in a finite amount of memory. switch with MAC addresses until the CAM table is full, at which point. It will simply update its MAC address table with the location of the most recent frame arriving with the duplicate MAC address. ARP Table (Layer 3) The ARP table is used to map MAC Addresses. 2. The maximum default time an entry will be kept on the table is 300. Which of the following best describes what the switch does with the message? and more. Reply. This guide will use the term CAM table moving forward. Mac address table overflow is a security vulnerability which attackers exploit by overflooding the CAM table to sniff the traffic. Term. 5 min read. Improve this answer. If the frame contains a Layer 3 packet to be forwarded, the destination MAC address is that of a Layer 3 port on the switch. In a typical LAN environment where there are multiple switches connected on the network, all the switches receive the unknown destination frame. The switch stores the MAC information in a table called the CAM table or the MAC table. CAM table poisoning is one of them. In more recent Cisco IOS versions, the syntax has changed to use the keywords mac address-table (first hyphen omitted). So, yes, there are multiple IP entries for the one MAC. It is a binding between a MAC address, VLAN and a port number on the switch. 3. TCAM stands for Ternary Content Addressable Memory. Bravo. the switch starts to broadcast. The switch views the Content Addressable Memory (CAM) table for the MAC address 00-bf-ac-10-00-01, and since there is no port registered with the NLB cluster MAC address 00-bf-ac-10-00-01, the. Each CAM table lookup is based on a hash key associated with a destination MAC address and VLAN ID. The data frames are sent over the network. what it contains, 2. It is used for Layer 2 frame forwarding and ARP tables. Also to change a MAC manually the full commands are . The problem that I am suggesting does not have anything to do with ports 1 or 2 talking to ports 3 or 4. 2 Answers Sorted by: 14 MAC Table (Layer 2) The MAC table is used by the switch to map MAC Addresses to a specific interface on the switch. Today is the difference between the CAM and TCAM. It is composed of the IP address and its MAC ADDRESS. 123. 12-18-2012 04:42 PM. Switches will automatically populate the CAM table from framers that pass through the switch. There’s not much to see here yet, though, since we haven’t hooked anything up to the. And the article doesn't address my question regarding IP addresses and TCP ports, and their relation to CAM tables. 璿的筆記. The switch sends out a frame to all forwarding ports within the respective VLAN when the destination MAC address is aged out from the CAM table. Storm Control allows you to set a threshold for Broadcast, Multicast, and Unicast Traffic entering a switchport that. It is composed of the IP address and its MAC ADDRESS. Plus, a new change this year sees the 15 Pro Max get the most capable camera with the telephoto lens getting a 5x optical zoom. if conditions a) and b) happen there is an uniknown unicast flooding, but as soon as the intended destination MAC address answers back the CAM entry is created again and unknown unicast flloding stops for that MAC address . Look a cut-through switch receives and examines only the first 6 bytes of a frame, which carries the DMAC address. •Common LAN switch attack is the MAC Address Table Flooding attack. In the static option, we manually add MAC addresses to the CAM table. This fills in the switch’s CAM table, thus new MAC addresses can not be saved, and the switch starts to send all packets to all ports, so it starts to act as a hub, and thus we can monitor all traffic passing through it. Since a CAM table is maintained for every VLAN, and VLANs are totally segmented between each other, it would not be a problem to have the same MAC address on two. Now applying this to networking devices, when looking up an address in the MAC address table, you always require an exact match, so CAM is used. 0. a18b. Look at the switch port shown in the entry and move to the neighboring switch connected to that port. For IPv6 hosts, see NDP Table. ARP table = layer 3. This table is called a Content Addressable Memory (CAM) table. To get a better idea of how the MAC addresses are stored within the CAM table, we'll use the following network topology to demonstrate:This feature allows you to set the MAC Address Table configuration. CatIOS devices: show mac. Then, repeat the CAM table process. Generally, for security-related purposes, it is the default value. The CAM table has a limited size and if you manage to exceed that size the switch isn't able anymore to assign new MAC addresses to a physical port. Table lookup is fast and always based on an exact key match consisting of two input values: 0 and 1 bits. TCAM memory does not require the ASIC to execute loops through an algorithm to search the table. The MAC Learning Process described below; STEP1-. mac-address-table was used until Catalyst IOS ver 12. this video, Keith Barker covers CAM table overflow attacks. 4. the lan switch learns from user traffic out what port a mac address is looking at source MAC address of. Omada: how to view switch MAC address to port table? (aka CAM table) AlreadyInUse. It suggests that some switches "do not allow spoofing of ARP packets". What is the 48-bit address used by a switch to make frame forwarding decisions? A. 1. The tables are stored in content-addressable memory (CAM) and ternary content-addressable memory (TCAM). TCAM requires an exact match. That MAC address is assigned to PortChannel1. تفاوت جدول MAC و جدول CAM در سویچ چیست؟. تفاوت جدول MAC و جدول CAM در سویچ چیست؟. Go to solution. Eavesdropping. 4. Thank you Daniel. - CAM table (or MAC table) was stored in DRAM of routers (or switches) This is not a precise statement. For this type of entry, the MAC address. When that packet reaches a switch, the switch will move the packet to the appropriate port based on the MAC address (from the switches port/MAC table). When downstream switches from the Root start receiving the BPDUs with the Topology Change (TC) bit set to 1, it will reduce the CAM tables aging timer from the default 300s to the current FWD_DELAY time (15s default). Share. The mac-address-table static mac-address vlan vlan-id interface int disable-snooping command disables snooping on the. Q :- What is the difference between Routing Table vs MAC Table?Answer :-MAC TableStands for Media Access Control, A MAC address table, sometimes called a Con. however, I think you're over thinking the problem. Cisco Catalyst 3750-X and 3560-X Series Switch Scalability Numbers. As soon as the user tries to ping host. MAC flooding involves flooding of CAM table with fake MAC address and IP pairs until it is full. The MAC address table is contained in CAM, and ACL and QoS information is stored in TCAM. 2. Suppose the router has learnt the mac of a connected PC via the arp process and at 900 secs when the arp timer. [edit vlans employee-vlan] user@switch# set mac-table-aging-time 200. Switches dynamically learn MAC addresses of each connecting CAM table. Since these attacks target switched LAN networks, let’s quickly examine how such a network generally works. The MAC address table is contained in CAM ACL and QoS information is stored in TCAM. The CAM table is the primary table used to make Layer 2 forwarding decisions. If no entry exists, it will add the MAC of Host A plus the port to which Host A is connected to its CAM table. In new IOS. The overall goal is to. If the ARP requests are for the same IP, due to the ARP table overflowing frequently, the switch should rate. 2. Routing Table D. MAC Address Table is full and it is unable to save new MAC addresses. It will flood it out all ports except the receiving port of the frame. When Device A, with MAC address A, sends a frame destined for Device B, with MAC address B, the switch looks at the source MAC address from Port 1 and installs MAC address A into the CAM. Memoria CAM y TCAM. Ran show mac address-table on different switches and core itself (on the core, for example, plugged by desktop directly, my desktop ), and we can see the several different MAC hardware address being registered to the interface, even. 6. The router has a single table (CAM - content addressable memory) where it stores things like MAC address associations. 2. You can start a new thread to share your ideas or ask questions. However, the 4500 and 6500 continue to use mac-address-table. Content Addressable Memory (CAM) table is a system memory construct used by Ethernet switch logic which stores information such as MAC addresses available on physical ports with their associated VLAN Parameters. MAC Address Table . Thus that MAC address would age out of the CAM table in 4500. After the table is full, all traffic with an address not in the table is flooded out all interfaces. The ports are restricted and learn up to a maximum of 10 dynamically-learned addresses D. 0a9. 1x Configuring static MAC addresses All of these O Configuring port security While configuring an interface on a switch. Suppose Computer A is connected to an Ethernet cable that plugs into the switch's Port 1, Computer B is connected to Port 2, and Computer C to Port 3. A switch learns unicast MAC addresses into its source address table or CAM table by inspecting each frame's source address. When looking up a prefix in a routing table, you don’t need an exact match, as long as the destination is contained within the prefix in the routing table, and that is where TCAM is used. 04-28-2015 12:44 AM. The address is located on port 3/2, and the switch makes a static entry in the CAM table for 01-00-5e-0a-0a-0a bounded to port 3/2. The SW6's MAC table contains the SW7 interfaces' MAC addresses. The "Macof" tool is used to fill CAM table of target switch in few seconds. And then you have to look at the refresh and timeout for each table but generally dynamic ARP entries expire earlier to prevent them from becoming stale, causing conflicts when a device moves and/or wasting space. 9abc. This CAM table overflow attack turns the switch into a hub, meaning it enables the attacker to see the traffic going in/out of the switch. CAM table stores mac address, port and associated vlan parameters. 3. Share. It is a Layer 3 to Layer 2 mapping. Well, the sticky option will put the learned MAC into CAM table as 'static', then the port security config will keep track of other mac addresses on configured port and take configured action with 'violation error' if wrong MAC address is detected. For Cisco IOS software, issue the mac-address-table aging-time command. . z router. 5e01. This flood of data causes the switch to dump the valid addresses it has in its CAM database tables in an attempt to make room for the bogus. 03-02-2010 02:01 PM. and no entry in the arp-cache. A CAM overflow attack occurs when an attacker connects to a single or multiple switch ports and then runs a tool that mimics the existence of thousands of random MAC addresses on those switch ports. Any packets with a source MAC address that is not on the approved list will not be saved to the forwarding table. When a switch is powered on, it doesn't know where each end device is located on the network. The ARP cache entries are generally for devices that are directly attached to the Layer 3 device. If you specify an address but do not specify an interf ace, the address is deleted from all. Layer 2 switches have a MAC address table timeout or CAM aging timer which Cisco sets for 300 seconds by default. CAM Table Overflows occur when an influx of MAC addresses are flooded into the table and the CAM table threshold is reached. But when I issue the "show mac address-table" command, the switch only shows the usual "STATIC CPU" addresses, and not the DYNAMIC ones, which are those of the SW7's interfaces. Using a too large (even if its default) arp timeout means that the dist-router. CLN member. There is a source endpoint and a destination endpoint with two separate. z. ARP table is populated using ARP requests , ARP replies and received gratuitous ARP by each device. You cannot configure separate MAC table aging times for specific VLANs. ) to relate a layer-3 (IPv4) address to a layer-2 (MAC) address. (300 seconds is a common value but it can be another value, and it may be configurable, depending on the switch vendor / model / software version). A. Second, the ASIC needs to perform table lookup in the MAC address table, so for fast table lookup, the switch uses a specialized type of memory to store the equivalent of the MAC address table: ternary content-addressable memory (TCAM). O CEF descarta pacotes em intervalos regulares O Cisco Express Forwarding (CEF) é uma tecnologia de comutação IP de. 璿的筆記. The CAM table contains the MAC addresses of all known hosts and to which port they are connected. Reading the Official Certification Guide, and Foundation Learning Guide, I was led to believe that CAM was used for the layer 2 forwarding table (CAM Table, aka Mac Address-table) and that TCAM was used for functions like QoS and Security ACL's. But I do have the object in. 3. Switch. See the article below :. Figure 14-1 shows the CAM table operation. So far everything is OK. به زبان خیلی ساده. json (you'll need to filter out the corresponding leaf). Switches use a hash to place MACs into the CAM table. Conversationalist. . The switch itself does not store this information in the CAM-table. 4. This flood of data causes the switch to dump the valid addresses it has in its CAM database tables in an attempt to make room for the bogus information. The switch enters these into the CAM table, and eventually the CAM table fills to capacity. Yes, this it still is a threat and this is why: MAC flooding is based on the overflow of the CAM Table (Content Access Memory). You can control MAC address learning on an interface or VLAN to manage the available MAC address table space by controlling which interfaces or VLANs can learn MAC addresses. Apr 27, 2021. The CAM table is empty until ingress traffic arrives at each port B. a IP Address 1. What do routers reference in order to make packet forwarding decisions? A. Sorted by: 4. The CAM table assigns physical ports to MAC addresses. In this process, the switch does not look at IP headers - only the DMAC is used for the forwarding. g. What does MAC flooding do? When an attacker tries to send a large number of invalid MAC addresses to the MAC table, this is known as MAC flooding. Hope this helps. R1 checks its routing table. MAC address: A MAC (Media Access Control. 01c then it looks that MAC address up in the CAM table. The CAM table shows which port the frame must be sent out in order for that frame to reach the specified destination MAC address. I need to find out what port a MAC address is connected to. I study for new 640-813. In your local network, you use the forwarding table to get the other hosts mac addresses and send them the packets. This removal is also called aging. Hi Neo, Yes Layer 2 switches forms cam table Actually a switch is a multi port bridge, it takes an incoming packet, and looks at the destination MAC address It decides what port to send the traffic to by looking at its CAM table (MAC to port # mapping) A switch does NOT do ARP to route ethernet frames A layer 2 switch does not even. It has to do this for every port. With Cisco since CAM is used for other functions you can adjust what the priority is through SDM template configuration based on how the switch will be used (e. For Cisco IOS software, issue the mac-address-table aging-time command. They are merely different representations of the same MAC address. 15 3 CAM vs. show (mac-address-table) Displays addresses in the MAC address table for a switched port or module. switch(config)# mac-address-table static 12ab. ff89 vlan 3 interface ethernet 2/1 To delete a static MAC address, perform this task: You can use the mac-address-table static command to assign a static MA C address to a virtual interface. ARP and CAM table. Hi, ARP gets the MAC address of a host or node and creates a local db that maps the MAC address to the hosts IP address. How to protect your network against MAC flooding attack. In an Ethernet switch, there is likely only one CAM table--the MAC table, so the terms have become. Short for the Content Addressable Memory table, a table in memory of switches set aside to store the MAC address to a port translation table. A CAM search function operates much faster than its counterpart in software, and thus CAMs are replacing software in search intensive applications such as address lookup in Internet routers, data compression, and database acceleration 2. The switch examines the destination MAC address of the frame. CAM Table Content Addressable Memory (CAM) table is a system memory construct used by Ethernet switch logic which stores information such as MAC addresses available on. The interfaces that were added are for H1, R1 and the internal interface. A switching table matches MAC Addresses with ports while a Routing table matches IP Address with Interfaces/ports. . 1D standards on a per-instance which follows the same rules. Configuring the Aging Time for the MAC Table. MAC address table, also known as Content Addressable Memory (CAM) table is a table that switches use to forward packets at layer 2. Fast-switching #2 is somewhat obsolete. The Catalyst 4500 and 6500 IOS Software are exceptions, however, and continue to use the mac-address. 2/ sh mac-address table count : Outps shows me 5K free. This specialised data structure makes it possible. If the interface is assigned, this field contains the given name of the interface in. Study with Quizlet and memorize flashcards containing terms like 1. Let’s turn this into a static entry: SW1(config)#mac address-table static 001d. Looking at the output of "sh cam dynamic x/x" the listed 'destination port' for the addresses is the switch access port the devices are connected to, thats a given. It involves overwhelming a switch’s MAC address table by flooding it with a massive amount of spoofed Ethernet frames, each containing a unique source MAC address. The CAM table is divided into "instances" that store the MAC addresses of the different VLANs. The CAM and mac address-table semantics are often used interchangeably. 1(11)EA1. Security Certifications Community. Keith covers jus. If you use this command just after turning on the switch, it displays a blank CAM table. If you have two networks, each with 100 devices on them, then the router has to learn, or remember, up to 200 MAC addresses. We are having an issue during automatic or manual failover where the MAC addresses for the virtual-servers are not being updated. If the flag is unset, delete the MAC address from the table. bbbb was missing, I have exported ARP and CAM tables from both switches. The switch makes a lookup in the dynamic CAM table to determine on which port the MAC address of the client PC is located. Selected as Best Selected as Best Like Liked Unlike Reply. CAM address C. Disabling MAC Address Learning on an Interface or VLAN. MAC A. The logical ip address related entries, the next device c will help traffic from the lab purposes and keeping the table and cam mac address la entre. 1. Forwarding table is a L2 table which states for communicating with z. To find the actual physical interface where that MAC address was learned, issue the command 'sh interfaces port-channel 1' or if you want to see a smaller output, 'sh interfaces port-channel 1 etherchannel' or 'sh interfaces port-channel 1 | i Members'. Example: Switch-01#sh mac-address-table count . The CAM uses high-speed memory that is faster than typical computer RAM due its search techniques. As mentioned earlier, MAC addresses are Layer 2 addresses that operate at the Data Link -Layer 2 of the OSI model. A MAC address, also known as “hardware address” or “physical address”, is a binary number used to uniquely identify computer network adapters. A switch builds its MAC. The switch adds a device MAC address in the CAM table only when it receives a frame from that device on any of its port. X. These are all different software techniques, with different performance in terms of the maximum number of packets that can be routed per second. Since a CAM table is maintained for every VLAN, and VLANs are totally segmented between each other, it would not be a problem to have the same MAC address on two. When you enable CAM table usage monitoring, the number of valid entries in the CAM table are counted and if the percentage of the CAM utilization is higher or equal to the specified threshold, a message is displayed. By default, MAC address learning is enabled on all interfaces and VLANs on the router. In old IOS. Here’s the MAC address of R1, learned dynamically. ago MartianPacket. If the. When a packet come to the router, it use the FIB to select the route and it use the next-hop. Does that mean, even if there is a MAC address in the. The cam table of the switch know pc 1 and pc2. Recall that a CAM table takes in an index or key value (usually a MAC address) and looks up the resulting value (usually a switch port or VLAN ID). Routing table is a Layer 3 table which states that for X. –Omada: how to view switch MAC address to port table? (aka CAM table) This thread has been locked for further replies. Add a comment. چند روز پیش یکی از کاربران توسینسو از من در خصوص تفاوت بین MAC Table یا جدول آدرس های سخت افزاری شبکه و همچنین تفاوت آن با CAM Table یا جدول حافظه. I shut down the secondary link and then CAM table of the primary started filling up and packet loss. In computer networking, a media access control attack or MAC flooding is a technique employed to compromise the security of network switches. Adding MAC addresses to the CAM table is a tedious task. STP uses a link-only protocol, so the frames do not pass beyond the link, and there is no need to enter in the CAM table, We have already covered this. 1. 2 - The SW adds A's MAC to the CAM table and floods the frame (But it doesn't change a thing) 3 - B receives the frame and responds to the ARP req with it's MAC. When performing a MAC address table lookup, the MAC address itself is the content being queried. It is a dynamic table that maps MAC addresses to. Figure 14-1 CAM Table Operation A to B MAC A MAC B Port. Memory Table Explanation: A router maintains and references a routing table for packet forwarding decisions. X. Introduction CAM (Content Addressable Memory) VS TCAM (Ternary Content Addressee Memory) CAM VS TCAM Laminated switches forward frames and packets at wire speed according using ASIC gear. I checked by logging into the Router. I don't believe there is a difference as such. The attack works by forcing legitimate MAC table contents out of the switch and forcing a unicast flooding behavior potentially sending sensitive information to portions of the network where. to enable Switching at Layer 2. When queried, it will always return a binary answer; 0 for true or 1 for false. When using TCAM – Ternary Content Addressable Memory inside routers it’s used for faster address lookup that enables fast routing. The MAC address table is where the switch stores information about the other Ethernet interfaces to which it is connected on a network. In a MAC address flooding attack, the attacker fills the switch's Content Addressable Memory (CAM) table with invalid MAC addresses. An exception is an ARP entry for an interface-based static route that goes to a destination that is one or more router hops away. " A- Correct, therefore B incorrect As frames arrive on switch ports, the source MAC addresses are learned and recorded in the CAM table. bbbb. Show mac address-table shows what MAC addresses have been learned (per VLAN). Information like MAC addresses, the routing table, or access lists are stored in these ASICs. That is the Po1 in the result you got. A MAC address table, sometimes called a Content Addressable Memory (CAM) table, is used on Ethernet switches to determine where to. g. In the dynamic option, the switch automatically learns and adds MAC addresses to the CAM table. Generally, the entries are for devices that are directly attached to the routing switch. The ports are restricted and learn up to a maximum of 10 dynamically-learned addresses D. A CAM table uses entries to store information. You can see the counter in the Tools tab of any switch or L3 Switch or MX. Overall, the general answer is correct. To add entries into the CAM table, set the aging time for the CAM table, and configure traffic filtering from and to a specific host, use the set cam. Go to cmd ---> type ARP -a to fetch ARP table in windows. The ARP table is a result of an ARP request after the ARP reply is received. Hi All. z. CAM ( Content Adressable Memory) is a special kind of memory where you can implement your mac-address table. The mac address or CAM table shows the Vlan associated with the port, MAC being learned on the port (i. The CAM table is the primary table used to make Layer 2 forwarding decisions. Good point. Initially both switches MAC tables have an entry for another switch only. STEP2-. TCAM provides three. 1x port-based NAC. Memoria CAM y TCAM. CAM is used to build routing tables. In switches CAM – Content Addressable Memory is used for building and lookup of mac address table that enables L2 forwarding decisions. C. It tells the switch which port to forward frames given a specific MAC address. If you do a show mac-address-table, you’ll see the CAM table — a table of MAC addresses that the switch knows; you would think that it would be empty since nothing’s plugge din, but the switch has its own MACs, so it always knows those guys. The subnet on which Host A resides is a directly connected subnet. ARP table is used to populate IP-MAC info in both CAM and Adjacency Tables. MAC flooding is a technique of compromising the security of network switches that connect devices. Mitigating options include ports with pre-configured MAC addresses and 802. A “MAC table” tells you what data the table holds whereas a “CAM table” tells you in technical nature of the table – a content-addressable memory, or a cache, which. You can lookup in the the table of any device within the same (V)LAN but the device that is the most likely to have the info is the router that act as the gateway for this (V)LAN. What happens next? A new entry is added to the CAM table, mapping the source device's MAC address to the port on which the frame was received. Indeed the FIB contain the best route selected from the RIB. Configuring the Aging Time for the MAC TableContent-addressable memory (CAM) is the heart of the function of a switch, as it pertains to MAC address-to-network-port assignments for lookup by the switch. ARP table = layer 3. 2. MAC address so it appears to outdoor the MAC address that was registered by the ISP. Reply to A's IP address will get wrapped in the wrong. The MAC address is a unique 48-bit hardware identifier number assigned to the Ethernet interface of any host. A MAC address table, sometimes called a Content Addressable Memory (CAM) table, is used on Ethernet switches to determine where to forward traffic on a LAN. The Adjacency table records IP address and Layer 2 header for the IP and then references the TCAM table and at this point the switch will have enough information to rewrite the packets headers and send them out the egress port. The switch also adds the router port 3/1 to the static entry for that GDA. It is also known as associative memory or associative storage and compares input search data against a table of stored data, and returns the address of matching data. The CAM can store MAC table and many other kinds of data - it is not limited to pure MAC addresses. I did some research and it looks like that Catalyst series switches apparently have this command, "show CAM {MAC}" which is. MAC addresses are used by network switches to keep track of what devices are connected to each switch interface and they store these mappings in a table called a CAM table or MAC address table. When looking up a prefix in a routing table, you don’t need an exact match, as long as the destination is contained within the prefix in the routing table, and that is where TCAM is used. z router. For example, if you have 1000 devices. 1. Hello Edwin, I was under the impression that port security was entirely separate from the MAC table. CAM - Content Addressable Memory: This table holds all of the MAC address information the switch has. It is a search engine-based computer memory used for various search applications. If you have two networks, each with 100 devices on them, then the router has to learn, or remember, up to 200 MAC addresses. 1. It performs the entire search operation in a single clock cycle. It is a specialized version of CAM depicted for quick table lookups. The CAM table is the primary table used to make Layer 2 forwarding decisions. a. CAM Table B.