Skip to content

Beginner · Ethernet, MAC addresses and the Cisco CLI · topic 8 of 57 · 25 min

How a switch learns and forwards

Explanation

A switch builds a MAC address table by reading the source MAC of every frame it receives and noting the port. To forward, it looks up the destination MAC: if it knows the port, it sends the frame only there; if not, or for a broadcast, it floods the frame out of every other port. Entries that are not used for 300 seconds (the Cisco default) are removed.

Why learning matters

A hub sends every frame everywhere. A switch is useful because it sends frames only where they need to go. To do that it needs to know where each device is, and it learns this by itself, with no configuration.

The four actions: learn, forward, flood, filter

  1. Learn: when a frame arrives, the switch reads its source MAC address and writes "this MAC is on this port" in its MAC address table (also called the CAM table). If the entry already exists, it refreshes the timer, or updates the port if the device has moved.
  2. Forward: it looks up the destination MAC. If the table has it on another port, the frame goes out of that one port only.
  3. Flood: if the destination is broadcast (ffff.ffff.ffff), a multicast the switch has no special handling for, or a unicast address not in the table (an unknown unicast), the switch sends the frame out of every port except the one it came in on.
  4. Filter: if the destination MAC is on the same port the frame came in on, the switch drops it, because the destination already got it.
Think of it like this: Think of a new receptionist at a hostel who does not know which room anyone lives in. When someone hands her a letter for Ravi, she announces it on every floor (flooding). When Ravi comes down to collect it, she notes "Ravi, room 14" (learning from the source). Next time a letter for Ravi arrives, she takes it straight to room 14 (forwarding).

A worked example

A switch has PCs A on port 1, B on port 2 and C on port 3. The table starts empty.

FrameLearnedAction
A to BA is on port 1B unknown: flood out of ports 2 and 3
B to AB is on port 2A known on port 1: forward out of port 1 only
C to broadcastC is on port 3Broadcast: flood out of ports 1 and 2
A to CA refreshedC known on port 3: forward out of port 3 only

Notice that the switch learns only from source addresses. It never learns a location from a destination address.

Aging

Devices move and get unplugged, so entries cannot last forever. On Cisco switches, a dynamic entry that has not been seen as a source for 300 seconds (5 minutes) is removed. This is the aging time. If that device talks again, the switch learns it again.

Looking at the table on a Cisco switch

output
Switch# show mac address-table
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0011.2233.4401    DYNAMIC     Gi0/1
   1    0011.2233.4402    DYNAMIC     Gi0/2
   1    0011.2233.4403    DYNAMIC     Gi0/3
  10    00aa.bbcc.dd01    DYNAMIC     Gi0/24
Total Mac Addresses for this criterion: 4
Cisco IOS: each learnt MAC address, its VLAN and its port.
output
Switch# show mac address-table dynamic interface g0/24
Switch# show mac address-table aging-time
Switch# clear mac address-table dynamic
Cisco IOS: filter by port, show the aging time (300 by default), and clear the learnt entries.

If one port shows many MAC addresses, there is probably another switch, or a virtual machine host, connected to that port. That is normal on links between switches.

Per-VLAN tables and limits

A switch keeps the table per VLAN (VLANs are covered in a later module), and floods only within the VLAN the frame belongs to. The table has a size limit. An attacker can flood a switch with thousands of fake source MAC addresses to fill the table, after which it floods everything like a hub. Port security, covered in the security module, stops this.

Careful: Common mistakes: saying a switch learns from the destination address (it learns from the source), saying a switch floods broadcasts back out of the port they came in on (never), and thinking a switch with an empty table drops frames (it floods them). Also, unknown unicast flooding is normal for a moment; it only becomes a problem when it never stops.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

How a switch learns and forwards · 1/7

How a switch learns

A switch sends frames only where they need to go. To do that, it learns where every device is.

Prefer a video by a teacher? Find free videos on “how a switch learns MAC addresses forwarding flooding filtering CCNA” on YouTube ↗

In real life: Tracing a printer at an Infosys-style office campus

A help desk engineer needs to find which desk socket a misbehaving printer is plugged into. She knows its MAC address from the printer status page, so she runs show mac address-table address 0011.2233.44aa on the floor switch. It shows port Gi0/37. The patch panel label for port 37 says desk 4B-12. She walks straight there instead of checking 48 desks.

output
Switch# show mac address-table address 0011.2233.44aa
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  20    0011.2233.44aa    DYNAMIC     Gi0/37
Cisco IOS: find the port for one MAC address.

Practice (0/3 done)

Task 1 · Question

A switch receives a frame whose destination MAC is not in its table. What does it do?

Task 2 · Code · Python

Simulate a switch. Write run_switch(ports, frames) where ports is a list of port numbers and frames is a list of (in_port, src_mac, dst_mac). Start with an empty MAC table. For each frame: learn src_mac on in_port; then if dst_mac is "ffff.ffff.ffff" or unknown, flood (all other ports, in the order of ports); if dst_mac is known on in_port, filter (empty list); otherwise forward (a list with the one known port). Return a list with the result for each frame.

Task 3 · Practice

In Cisco Packet Tracer, connect three PCs to one 2960 switch. Give them IP addresses in the same network (for example 192.168.1.1 to 192.168.1.3 with mask 255.255.255.0). Run show mac address-table on the switch, then ping between the PCs and run it again.

Quick quiz

Question 1

1.Which address does a switch use to LEARN where a device is?

Question 2

2.What is the default MAC address table aging time on a Cisco switch?

Question 3

3.A frame to ffff.ffff.ffff arrives on port 5 of a 24-port switch (all in one VLAN). Where does it go?

Question 4

4.Which command shows the MAC address table on a Cisco switch?

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

Which address does a switch use to LEARN where a device is?

Answer: The source MAC address

Switches learn from the source MAC address of incoming frames.

What is the default MAC address table aging time on a Cisco switch?

Answer: 300 seconds

Dynamic entries are removed after 300 seconds without traffic. 4 hours is the Cisco ARP timeout.

A frame to ffff.ffff.ffff arrives on port 5 of a 24-port switch (all in one VLAN). Where does it go?

Answer: All ports except port 5

Broadcasts are flooded out of every port except the incoming one.

Which command shows the MAC address table on a Cisco switch?

Answer: show mac address-table

show mac address-table lists VLAN, MAC, type and port.

An IP phone and a PC share one switch port. Which command puts the phone traffic in VLAN 50?Related

Answer: switchport voice vlan 50

switchport voice vlan 50 tells the phone to tag voice frames with VLAN 50; the PC stays in the access VLAN.

From VLANs: what they are and why we use them

A switch log keeps saying a host is "flapping between port Gi0/1 and port Gi0/2". What does this suggest?Related

Answer: A layer 2 loop

MAC flapping means the same source MAC keeps arriving on different ports, a typical sign of a loop.

From Why layer 2 loops are deadly

Which configuration helps prevent VLAN hopping by switch spoofing?Related

Answer: switchport mode access on user ports

An access port does not negotiate a trunk, so a host cannot use DTP to turn it into one.

From Layer 2 security: port security, DHCP snooping, DAI

What is the Ethernet broadcast MAC address written in Cisco format?Related

Answer: ffff.ffff.ffff

Broadcast is all ones. 255.255.255.255 is the IPv4 broadcast, not a MAC address.

From Ethernet frames and MAC addresses

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: ARP, the default gateway and ping →

Next steps

  1. 2 more topics in “Ethernet, MAC addresses and the Cisco CLI” before its exam: ARP, the default gateway and ping, The Cisco IOS command line.
  2. Module 2 exam: Ethernet, MAC addresses and the Cisco CLI · 13 questions · 20 min, without help. 5 topics of this module still to finish first.
  3. Then the next module, IPv4 addressing. 57 topics left in the course before the final exam.

← Previous: Ethernet frames and MAC addresses