How Ethernet Switches Learn MAC Addresses and Forward Frames

Learn how Layer 2 switches build MAC address tables, learn source MACs, and forward, flood, filter, or discard Ethernet frames within VLANs.

An Ethernet switch is a Layer 2 device that forwards Ethernet frames by examining their destination MAC addresses. It learns where devices are connected by examining source MAC addresses, then uses that information to make later forwarding decisions.

This lesson explains MAC learning, known and unknown unicast forwarding, broadcast and multicast flooding, VLAN boundaries, aging, loop prevention, forwarding methods, and Cisco IOS verification commands.

The Layer 2 Role of an Ethernet Switch

An Ethernet switch receives a frame on an ingress port, also called the incoming port, and decides whether to send it through one or more egress ports. The primary inputs to this decision are the frame's destination MAC address and its VLAN context.

A switch does not normally need to inspect the IP address in an ordinary Ethernet forwarding decision. IP addresses matter to routers and Layer 3 forwarding, while a Layer 2 switch uses Ethernet MAC addresses.

A hub behaves differently. A hub repeats an electrical or bit-level signal out all other ports, without maintaining a MAC address table or making a per-frame destination decision. A switch normally sends a frame only where it needs to go, although some frames must be flooded when their destination is unknown or inherently one-to-many.

Switching decisions occur within a VLAN. Each VLAN is an independent Layer 2 forwarding domain. A frame in VLAN 10 is looked up and flooded only in VLAN 10; it is not automatically sent into VLAN 20.

Ethernet Frame Fields Used by a Switch

An Ethernet frame includes two important Layer 2 addresses:

Source MAC address: identifies the interface that sent the frame. The switch uses it for MAC learning.
Destination MAC address: identifies the intended receiver or receivers. The switch uses it for the forwarding decision.

Destination MAC addresses can be classified as follows:

Unicast: intended for one interface. A known unicast can be sent through one port; an unknown unicast is flooded within its VLAN.
Broadcast: intended for every device in the VLAN. The Ethernet broadcast address is FF:FF:FF:FF:FF:FF.
Multicast: intended for a group of interfaces. The switch's behavior depends on its multicast capabilities and configuration.

MAC Address Table Terminology

A switch maintains a MAC address table, also called a CAM table or forwarding database. It maps a MAC address to a switch interface within a particular VLAN.

Term	Meaning
Dynamic MAC entry	An entry learned automatically from a received source MAC address.
Static MAC entry	An entry configured manually or controlled by a feature such as port security.
VLAN identifier	The Layer 2 forwarding context in which the MAC address was learned.
Interface or port	The switch port associated with the MAC address.
Aging timer	The inactivity timer used to remove a dynamic entry after it has not been refreshed.

An entry can be represented conceptually as VLAN 10, MAC 0011.2233.4455, port Fa0/1, dynamic. The table is local to each switch. Switches do not automatically share their complete MAC tables with one another; each switch learns from frames that it receives.

Frame-Processing Sequence

A typical Layer 2 switch processes a frame in this order:

Receive the frame: the switch accepts a frame on an ingress port.
Identify the incoming VLAN: an access port supplies an untagged frame to its configured access VLAN. A trunk identifies the VLAN using an 802.1Q tag where tagging applies.
Learn the source: the switch records or refreshes the source MAC address against the ingress port and VLAN.
Look up the destination: the switch searches for the destination MAC address in the same VLAN.
Choose an action: it forwards, floods, filters, or discards the frame according to the result and port state.

Source learning occurs before the forwarding decision. The switch normally does not send a received frame back out the same ingress port.

Dynamic MAC Address Learning

Suppose a frame with source MAC AAAA.AAAA.AAAA arrives on Fa0/1 in VLAN 10. If that source is not already in the table, the switch creates a dynamic entry. If the entry already exists on that port, receiving another frame refreshes its aging timer.

If the same source MAC later arrives on Fa0/8 in VLAN 10, the switch treats this as a MAC move and updates the entry to Fa0/8. A move can be normal when a laptop is relocated, a virtual machine changes attachment points, or a downstream switch is connected. Frequent or rapid moves can indicate a Layer 2 loop, incorrect cabling, or an unstable topology.

Step	Received source MAC	Ingress port	Destination result	Action	Learned entries
First frame from Host A	AAAA.AAAA.AAAA	Fa0/1, VLAN 10	Host B unknown	Flood within VLAN 10 except Fa0/1	Host A maps to Fa0/1
Reply from Host B	BBBB.BBBB.BBBB	Fa0/2, VLAN 10	Host A known on Fa0/1	Forward only to Fa0/1	Host A maps to Fa0/1; Host B maps to Fa0/2
Later A-to-B frame	AAAA.AAAA.AAAA	Fa0/1, VLAN 10	Host B known on Fa0/2	Forward only to Fa0/2	Both entries refreshed
Expiration or move	None, or a source received on a new port	Depends on event	Destination may be unknown, or source mapping changes	Flood if unknown; update the port if moved	Entry ages out or is replaced

Known Unicast Forwarding and Filtering

A known unicast is a unicast frame whose destination MAC address exists in the MAC table for the frame's VLAN. If the entry maps to a different active forwarding port, the switch sends the frame only through that port.

For example, if Host B is learned on Fa0/2 in VLAN 10 and a frame for Host B arrives on Fa0/1 in VLAN 10, the switch forwards it to Fa0/2. Other eligible ports do not receive a copy, which reduces unnecessary traffic.

If the destination is learned on the same port where the frame arrived, the switch filters the frame rather than forwarding it elsewhere. This prevents needless transmission. It can also reveal a topology or host communication issue if the situation is unexpected.

Unknown Unicast Flooding

An unknown unicast has a unicast destination MAC address that has no matching entry in the local table for the frame's VLAN. The switch cannot identify one destination port, so it floods the frame out all eligible forwarding ports in that VLAN except the ingress port.

The destination host can receive the frame and reply. The reply contains the destination host's MAC address as its source address, allowing the switch to learn the host's location. Later traffic can then use known-unicast forwarding.

Unknown-unicast flooding is not the same as sending traffic to every port on the switch. The flood is limited to the originating VLAN and to ports that are eligible to forward that VLAN. It does not cross into every VLAN.

Broadcast and Multicast Handling

Broadcast frames use FF:FF:FF:FF:FF:FF as the destination MAC address. A switch floods a broadcast within its VLAN, excluding the ingress port. An ARP request is a common IPv4 example.

Multicast forwarding depends on switch capabilities and configuration. Without multicast-aware controls, a switch may flood multicast traffic within the VLAN. IGMP snooping allows a switch to observe IPv4 multicast membership messages and constrain multicast delivery to ports with interested receivers.

Routers and Layer 3 interfaces separate VLANs. Ordinary Layer 2 broadcasts do not cross a router or a Layer 3 VLAN boundary unless a specific Layer 3 service generates a new, separate transmission.

Destination condition	MAC table result	Switch action	Ports that can receive the frame	VLAN scope
Known unicast on a different port	Matching destination entry	Forward to the destination port	Destination forwarding port	One VLAN
Known unicast mapped to ingress port	Destination equals ingress port	Filter; do not forward elsewhere	None	One VLAN
Unknown unicast	No matching entry	Flood	Eligible forwarding ports except ingress	One VLAN
Broadcast	Not dependent on a unicast lookup	Flood	Eligible forwarding ports except ingress	One VLAN
Multicast without optimization	May not have receiver-specific state	Usually flood	Eligible ports except ingress	One VLAN
Multicast with IGMP snooping	Receiver membership is tracked	Constrain forwarding	Interested eligible ports	One VLAN

VLAN Boundaries and Trunk Links

MAC learning and destination lookups are VLAN-specific. The same MAC address can appear in separate VLAN contexts without being one shared forwarding entry. Conceptually, VLAN 10 + MAC X and VLAN 20 + MAC X are different table keys.

An access port belongs to one access VLAN and normally carries frames for that VLAN without an 802.1Q tag on the host-facing link. A trunk port carries traffic for multiple VLANs between network devices. VLAN identification commonly uses IEEE 802.1Q tagging on trunk traffic.

Flooding over a trunk is selective. A broadcast or unknown unicast is sent across the trunk only for a VLAN that is active and allowed on that trunk. It is not copied into VLANs that are not allowed.

For VLAN configuration details, see Configure Trunk Ports. A router-on-a-stick design uses a trunk to carry multiple VLANs to Layer 3 subinterfaces; see Configure Router on a Stick.

Aging and Table Maintenance

Dynamic entries expire after a period of inactivity. Aging prevents a switch from retaining obsolete locations indefinitely when a device is disconnected, moved, or replaced.

After an entry ages out, a future frame addressed to that MAC becomes an unknown unicast. The switch floods it within the VLAN until the destination transmits and its source MAC is learned again.

Static MAC entries do not behave like ordinary dynamic entries. They are manually controlled and are not normally removed by the dynamic aging process. Static configuration should be used deliberately because an incorrect static mapping can prevent normal learning and forwarding.

Loop Prevention and Forwarding-Port State

Redundant Layer 2 paths can create loops. A looping frame may be flooded repeatedly, duplicate frames may reach hosts, and the same source MAC may appear alternately on different ports. These symptoms can produce excessive traffic and unstable MAC tables.

Spanning Tree Protocol, or STP, prevents this by placing selected redundant paths into a non-forwarding state. The result is one active Layer 2 forwarding path between switched segments while redundant links remain available for failover. A port that is not in a forwarding state does not participate in normal data-frame forwarding.

Switch Forwarding Methods

Forwarding method describes when a switch begins transmitting a frame. It is separate from the MAC-table lookup decision. A switch can know the correct egress port while using different methods to determine when transmission begins.

Method	When forwarding can begin	FCS validation before forwarding	Latency characteristic	Error-frame consideration
Store-and-forward	After the complete frame is received	Yes	Higher than cut-through because the whole frame is buffered	Can discard frames that fail the Frame Check Sequence
Cut-through	After enough header information is received to identify the destination	Not necessarily before forwarding begins	Lower latency	May forward a damaged frame before detecting its error
Fragment-free	After waiting for the initial portion of the frame	Not a complete-frame FCS check before forwarding	Intermediate latency	Designed to avoid forwarding most early collision fragments; largely historical

FCS means Frame Check Sequence. Store-and-forward switching checks the complete frame's FCS before forwarding, while cut-through can reduce latency by beginning earlier.

Worked Example: Two Hosts in VLAN 10

Host A is connected to Fa0/1 and Host B to Fa0/2. Both ports belong to VLAN 10, and the switch's table is initially empty.

Host A sends a frame to Host B. The switch learns Host A's source MAC on VLAN 10 and Fa0/1.
Host B's destination MAC is unknown, so the switch floods the frame to eligible VLAN 10 forwarding ports except Fa0/1.
Host B receives the frame and sends a reply. The switch learns Host B's source MAC on VLAN 10 and Fa0/2.
Future frames from A to B are known unicasts and are forwarded only to Fa0/2. Traffic is not sent to unrelated VLAN 10 ports.

Worked Example: Broadcast ARP Request Across a Trunk

Three access ports belong to VLAN 20, and a trunk carries VLAN 20 to another switch. A host sends an ARP request with the Ethernet broadcast destination address.

The local switch floods the request to other forwarding VLAN 20 access ports.
The switch also sends the VLAN 20 broadcast across the trunk because VLAN 20 is active and allowed there.
The frame is not flooded into VLAN 10 or another VLAN.
The ARP reply is normally unicast. Its source MAC allows switches to learn the responder's location.

Worked Example: MAC Move

A laptop with MAC address CCCC.CCCC.CCCC moves from Fa0/3 to Fa0/8 in the same VLAN. When the laptop transmits on Fa0/8, the switch replaces the old mapping with VLAN, CCCC.CCCC.CCCC, Fa0/8.

A single move may be expected. Repeated rapid moves should be investigated because they can indicate a loop, a virtual machine moving between hosts, an unmanaged downstream switch, or incorrect physical topology.

Worked Example: An Aged-Out Destination

Host B has been idle long enough for its dynamic entry to expire. Host A then sends a frame to Host B's MAC address. Because the destination is no longer in the table, the switch treats the frame as unknown unicast and floods it within the VLAN. When Host B transmits again, the switch relearns its current port.

Verifying the MAC Address Table on Cisco IOS

Use these commands to inspect learned entries and their forwarding context:

show mac address-table
show mac address-table dynamic
show mac address-table vlan 10
show mac address-table interface fastethernet 0/1

Interpret the output by identifying the VLAN, MAC address, entry type, and interface columns. A dynamic entry should match the port where the device is currently connected. A static entry indicates manual or feature-controlled configuration.

Verify VLAN membership, trunk eligibility, interface status, and STP state with:

show vlan brief
show interfaces fastethernet 0/1 switchport
show interfaces trunk
show spanning-tree vlan 10

These checks answer different questions:

show vlan brief identifies access VLAN membership and basic port status.
show interfaces ... switchport shows the port mode and access VLAN context.
show interfaces trunk shows trunk status and VLANs allowed and active.
show spanning-tree vlan 10 shows whether a VLAN's port is forwarding or blocked.

Clearing Dynamic Entries in a Controlled Test

In a lab or approved maintenance window, dynamic entries can be cleared:

clear mac address-table dynamic
clear mac address-table dynamic vlan 10

After clearing, the switch temporarily knows fewer destinations. Traffic to a destination that has not yet been relearned is treated as unknown unicast and flooded within its VLAN. As devices transmit, their source MAC addresses are learned again.

Optional Static MAC and Port-Security Example

The following illustrates a manually controlled MAC-to-port expectation. It is not required for normal dynamic learning:

interface fastethernet 0/1
 switchport mode access
 switchport access vlan 10
 switchport port-security
 switchport port-security mac-address 0000.1111.2222

Troubleshooting Forwarding Behavior

Traffic Is Flooded Instead of Sent Directly

The destination's dynamic entry may have aged out.
The destination may be in another VLAN.
The required VLAN may not be allowed on a trunk.
The destination interface may be down or not in a forwarding state.

Inspect the destination MAC in the correct VLAN, verify access VLAN and trunk settings, and check interface and STP status.

A MAC Address Appears on an Unexpected Port or Moves Repeatedly

A host may have been physically moved.
A virtual machine or hypervisor may have changed attachment points.
An unmanaged downstream switch may be present.
A Layer 2 loop may exist.

Compare MAC-table output over time, trace physical cabling, inspect downstream devices, and review the spanning-tree topology.

Hosts in the Same IP Subnet Cannot Communicate

The ports may belong to different VLANs.
One port may be administratively down.
Spanning Tree may have placed a port in a non-forwarding state.
Port security or another policy may be preventing traffic.

Check VLAN membership, switchport mode, interface status, MAC learning, port-security status, and STP state. Confirm that each expected source MAC is learned on the intended port.

Broadcast or Unknown-Unicast Traffic Appears Outside the Expected Area

The expectation may ignore VLAN boundaries or trunk membership.
A VLAN may be permitted across a trunk when it should not be.
A loop may be replicating traffic.

Verify VLAN IDs on access and trunk ports, review allowed VLAN lists and STP status, and use interface counters or packet captures to identify repeated frames.

Exam-Relevant Summary

A switch learns from the source MAC address and forwards based on the destination MAC address.
Learning and lookup are performed within the frame's VLAN.
A known unicast on a different port is forwarded only to that port.
A known destination on the ingress port is filtered.
An unknown unicast is flooded to eligible ports in the same VLAN except the ingress port.
A broadcast is flooded within its VLAN using destination FF:FF:FF:FF:FF:FF.
Multicast behavior depends on configuration; IGMP snooping can limit delivery to interested ports.
Dynamic entries age out after inactivity, while static entries are manually controlled.
STP blocks selected redundant paths so blocked ports do not perform normal data forwarding.
Store-and-forward checks the complete frame and FCS before forwarding; cut-through reduces latency but may forward an errored frame before detecting it.