How does a switch learn MAC addresses and decide where to send a frame?
Show the answer
Say this first
It learns from the source MAC of every frame, recording MAC, VLAN and ingress port. To forward, it looks up the destination MAC in that VLAN. A known unicast goes out one port. Unknown unicast, broadcast and multicast (without IGMP snooping) are flooded to every port in the VLAN except the one the frame came in on. Entries age out after 300 seconds of silence on Cisco by default.
Go deeper
The four actions
- Learn. Source MAC plus VLAN maps to the ingress port. If the same MAC shows up on another port, the entry moves.
- Forward. Destination known and on another port: send it out that one port.
- Filter. Destination known and on the same port it arrived on: drop it. You only see this behind a hub or another unmanaged switch.
- Flood. Unknown unicast, broadcast, and multicast the switch has no snooping state for: send to every port in the VLAN, trunks included, except the ingress port.
Aging
The default is 300 seconds on Cisco IOS (mac address-table aging-time). Every frame from that MAC
resets the timer. Topology changes flush or shorten it, which is why a busy spanning tree causes flooding.
Looking at it
SW1# show mac address-table dynamic vlan 10
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
10 0050.56a1.0101 DYNAMIC Gi1/0/1
10 0050.56a1.0202 DYNAMIC Gi1/0/48
Total Mac Addresses for this criterion: 2The table is keyed on VLAN plus MAC, so the same MAC can live in two VLANs at once.
They will ask next
What happens when the MAC table is full?
The switch cannot learn new addresses, so frames to those hosts are flooded like unknown unicast. A MAC flooding attack (tools like macof) fills the table on purpose so the attacker sees other people's traffic. Port security, which caps MACs per port, is the standard defense.
Does a switch learn from broadcast frames?
Yes. Learning only looks at the source address. Most hosts get learned from their first ARP request, which is a broadcast.
Traps
- Saying a switch learns from destination addresses. It learns only from source addresses.
- Confusing MAC aging (300 seconds) with the ARP timeout (4 hours on Cisco IOS). They are different tables at different layers.