How does a network switch learn MAC addresses and make forwarding decisions?

Question

Accepted Answer

A network switch operates at Layer 2 of the OSI model and makes forwarding decisions based on MAC (Media Access Control) addresses. Unlike a hub, which blindly floods traffic out every port, a switch intelligently forwards frames only to the port where the destination device is connected. This is achieved through a process of learning, forwarding, and filtering.

The switch maintains a MAC address table (also called a CAM table or Content Addressable Memory table) that maps MAC addresses to specific switch ports. When the switch is first powered on, this table is empty.

The learning process works as follows. When a frame arrives on a port, the switch examines the source MAC address in the frame header and records the mapping between that MAC address and the port it arrived on. For example, if a frame with source MAC AA:BB:CC:DD:EE:01 arrives on port 1, the switch adds the entry "AA:BB:CC:DD:EE:01 is on port 1" to its MAC address table. Each entry has an aging timer (typically 300 seconds) that resets when traffic from that MAC is seen again.

For forwarding, the switch looks at the destination MAC address and checks its MAC address table. There are three possible outcomes. If the destination MAC is in the table and maps to a different port than the source, the switch forwards the frame only to that specific port. This is called unicast forwarding. If the destination MAC is not in the table, the switch floods the frame out all ports except the one it arrived on. This is called unknown unicast flooding, and it is how the switch discovers where devices are. If the destination MAC maps to the same port as the source, the switch drops the frame because the source and destination are on the same segment. This is called filtering.

Broadcast frames (destination MAC FF:FF:FF:FF:FF:FF) are always flooded to all ports within the same VLAN, because by definition they are intended for all devices. Multicast frames are also flooded unless IGMP snooping is configured.

The MAC address table has a finite size. If it becomes full, the switch floods all unknown unicast traffic, effectively behaving like a hub. This is actually the basis of a MAC flooding attack, where an attacker sends thousands of frames with random source MACs to fill the table and force all traffic to be broadcast. Port security features can mitigate this by limiting the number of MAC addresses learned on a port.

You can view the MAC address table on a Cisco switch with show mac address-table, which shows all learned entries along with their VLAN, MAC address, type (dynamic or static), and associated port.