Learning Objectives
- Understand how a switch learns MAC addresses and forwards frames
- Differentiate between flooding, filtering, and forwarding
- Interpret a MAC address table
How a Switch Learns
Unlike a hub that blindly repeats every frame out every port, a switch learns which MAC addresses live behind which port. This learning process is what makes switching efficient — each frame goes only to the port where the destination device sits, not every port.
When a switch powers on, its MAC address table (also called a CAM table) is empty. The learning process works like this:
- Frame arrives on a port with a source MAC and destination MAC
- Learn — the switch records the source MAC and maps it to the incoming port
- Lookup — the switch checks its table for the destination MAC
- Forward or Flood — if the destination is in the table, forward only to that port; if not, flood out all ports except the one it arrived on
Forwarding Decisions
A switch forwards Ethernet frames based on the destination MAC address. The table below shows three possible actions:
| Table Result | Action | Description | |---|---|---| | Destination found | Forward (filter) | Send frame only to the port where that MAC was learned | | Destination unknown | Flood | Send frame to all ports except the incoming port | | Destination is broadcast (FF:FF:FF:FF:FF:FF) | Flood | Always flood broadcasts — every device gets it |
This is why switches are more efficient than hubs. In a hub, every frame goes to every port. In a switch, a frame between two devices on the same switch stays only between those ports — other ports never see the traffic.
Switch with MAC Table
Hover over each device to see the switch's MAC address table and how it maps ports to learned MAC addresses.
MAC Address Table Aging
Switches don't hold MAC entries forever. If no traffic is seen from a given source MAC within the aging time (default is usually 300 seconds on Cisco switches), the entry is removed. This is essential when:
- A device is moved from one port to another — the switch must re-learn it on the new port
- A device goes offline — stale entries waste table space
- A NIC is replaced — the new MAC must replace the old one
If a device moves to a different port while its MAC is still in the table, the switch receives a frame with that source MAC on a different port and immediately updates the entry — this is called MAC flapping and can indicate a loop if it happens too often.
What happens when a switch receives a frame with an unknown destination MAC address?
Bandwidth Efficiency
Switching improves network efficiency in three ways. First, microsegmentation — each port is its own collision domain, so devices don't contend for bandwidth like they did on hubs with CSMA/CD. Second, simultaneous conversations — a switch can forward multiple frames at once because each port-pair conversation uses a dedicated circuit inside the switch fabric. Third, traffic isolation — unicast traffic between two devices on different ports doesn't consume bandwidth on unrelated ports.
The switch fabric's capacity is measured in Gbps (backplane bandwidth) — the total throughput the switch can sustain across all ports simultaneously. A 24-port gigabit switch with a 48 Gbps backplane can run all ports at full speed simultaneously.
Under what condition would a switch immediately update its MAC table entry without waiting for the aging timer?
Key Takeaways
- A switch learns MAC addresses by examining source MACs on incoming frames
- Unknown destination MACs cause flooding; known destinations are forwarded only to the relevant port
- The MAC table ages out entries after a configurable timeout to handle device moves and removals
- Switches provide microsegmentation — each port is its own collision domain
- Simultaneous forwarding is possible because each port-pair conversation uses a dedicated path through the switch fabric