How switches work: MAC address learning, flooding, forwarding and aging

The job of a switch

A switch connects devices in the same LAN and decides, for each frame, which port or ports it should leave from. It makes that decision using its MAC address table (often called the CAM table, after the fast content-addressable memory that stores it). Each entry maps a MAC address and VLAN to a port.

Learn, then forward, flood or filter

1. Learn: the switch reads the source MAC of the incoming frame and records it against the incoming port and VLAN, refreshing the timer if it already exists. It never learns from destination addresses.
2. Forward: if the destination MAC is in the table on another port, the frame goes out of that port only.
3. Filter: if the destination is on the same port the frame came in on, the switch drops it.
4. Flood: if the destination is unknown, or is the broadcast address, the frame goes out of every port in that VLAN except the one it arrived on.

So the first frame between two hosts may be flooded, but the reply teaches the switch where the second host is, and from then on traffic flows only between their two ports. This is what makes switches far more efficient and private than the old hubs, which repeated everything everywhere.

Aging and moves

Entries that are not refreshed are removed after the aging time, 300 seconds by default on most switches. This keeps the table accurate when devices are unplugged or moved. If the same MAC suddenly appears on a different port, the switch updates the entry at once. Repeated changes between two ports (MAC flapping) are logged and usually mean a Layer 2 loop or a misbehaving teaming setup.

show mac address-table dynamic
show mac address-table address 001a.2b3c.4d5e
show mac address-table interface GigabitEthernet1/0/5
show mac address-table aging-time
clear mac address-table dynamic interface GigabitEthernet1/0/5

Several switches together

With two switches connected by an uplink, Switch A learns every host on Switch B against its single uplink port. That is normal: from A's point of view all those addresses really are "out of that port". When you are tracing a device, follow the table from switch to switch: if the address is on an uplink, log in to the next switch and look again until you reach an access port with only one or two addresses on it.

MAC flooding and port security

The table has a fixed size. An attacker can send thousands of frames with random source addresses until it is full; new legitimate addresses then cannot be learned, so their traffic is flooded to every port where the attacker can capture it. Port security limits how many addresses each access port may learn and shuts the port (or drops the frames) if the limit is exceeded.

interface GigabitEthernet1/0/5
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict

Real-world example: to find a printer that kept dropping off the network, an engineer looked up its MAC on the core switch (it showed on uplink Gi1/0/48), then on the floor switch, where it appeared on Gi1/0/17. The port's error counters were climbing; a faulty wall-port patch was replaced. Tracing a MAC hop by hop like this is one of the most used skills in network support.