Switch MAC Learning and Forwarding

A switch keeps one structure that drives every forwarding decision: the MAC address table, also called the CAM table or forwarding table. Each entry maps a MAC address to a port — and, once VLANs exist, to a VLAN as well. The switch consults this table for every single frame and does exactly one of three things: forward it out one port, flood it out many, or filter it, meaning drop it.

Forwarding then happens on egress, using the destination MAC. Those two halves — learn from the source on the way in, look up the destination on the way out — account for essentially all of a switch's behaviour, and every later topic this week is a refinement of them.

Flooding an unknown unicast is not an error and not a failure mode — it is how a switch reaches a destination it has not heard from yet. The destination replies, that reply teaches the switch which port it lives on, and the next frame is forwarded rather than flooded. One round trip ends the flooding for that conversation.

A broadcast is different: it has no single owner, so there is never a single port to forward toward. It is always flooded to every port in the VLAN except the one it arrived on. That behaviour is exactly why a VLAN is called a broadcast domain, which is the subject of the next lesson.

Follow three frames on a switch that has just powered on with an empty table. Hosts A through D sit on Gi0/1 through Gi0/4.

By the second frame the flooding is over. One round trip is all it takes to learn both ends of a conversation, which is why a healthy switched network floods very little despite flooding being its default for anything unknown.

Dynamic entries are not permanent. Each carries a timer that resets every time the switch hears from that MAC again. If a host stays silent longer than the aging time — the Cisco default is 300 seconds — its entry is removed. The next frame it sends relearns it.

Aging is why the table reflects who is currently active rather than everything ever seen, and it explains a symptom that otherwise looks like a fault: an idle server can temporarily vanish from the table, and inbound frames for it get flooded until it says something. That is normal behaviour, not a problem to fix.

Relearning also handles movement. If a host is recabled from Gi0/2 to Gi0/4, the switch sees its source MAC arriving on a new port and updates the existing entry rather than adding a second one. MAC learning is not append-only — an entry moves, which is how a switch follows a host around the network.

Switch# show mac address-table
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0011.1111.1111    DYNAMIC     Gi0/1
   1    0022.2222.2222    DYNAMIC     Gi0/2
   1    0033.3333.3333    DYNAMIC     Gi0/3

Four columns, and each earns its place. Vlan is the broadcast domain the entry belongs to — from the next lesson onward this stops always reading 1. Mac Address and Ports are the mapping itself. Type distinguishes DYNAMIC entries, which were learned from traffic and will age out, from STATIC entries, which were configured and will not.

• Learn from the source MAC on ingress, mapping it to the port the frame arrived on.
• Look up the destination MAC on egress: forward for a known unicast, flood for an unknown unicast or broadcast, filter when the destination is already on the ingress port.
• Flooding is normal, not a failure — the reply ends it after one round trip.
• Dynamic entries age out after 300 seconds of silence by default, and relearn on the next frame.
• A recabled host's entry moves to the new port rather than duplicating.
• show mac address-table is the ground truth for what the switch has actually learned.