How Ethernet Switches Learn MAC Addresses

Learn how Layer 2 switches build MAC address tables, forward known unicasts, flood unknown traffic, filter frames, age entries, and troubleshoot MAC moves.

An Ethernet switch forwards Layer 2 frames by using MAC addresses. Its central reference is the MAC address table, which maps a device MAC address to a VLAN and switch interface. The table is also called a CAM table, forwarding database, or bridge table.

This process is a foundation of Ethernet switching and is distinct from routing. For background, review the OSI reference model and basic computer networking concepts.

Why switches learn MAC addresses

A MAC address is a Layer 2 hardware address used as the source or destination identifier in an Ethernet frame. When a switch receives a frame, it must determine which interface should transmit that frame next.

Without a learned destination, the switch cannot tell which port leads to the destination device. It must therefore send the frame out multiple eligible ports. Once the destination MAC is associated with a port, the switch can send a unicast frame only toward that port. This reduces unnecessary traffic and prevents unrelated devices from receiving ordinary unicast frames.

Learning requires the switch to associate a received frame's source MAC address with the ingress port, which is the interface where the frame entered. The switch then uses the destination MAC address for a separate lookup and forwarding decision.

MAC table, ARP cache, and routing table compared

Database	Layer and purpose	Typical information
MAC address table	Layer 2 switching	MAC address, VLAN, switch port, entry type, and aging state
ARP cache	Maps Layer 3 IPv4 addresses to Layer 2 MAC addresses	IPv4 address and corresponding MAC address on a host or router
Routing table	Layer 3 forwarding	Destination networks, next hops, and outgoing Layer 3 interfaces

A switch does not learn a MAC address from an ARP cache. It learns by examining Ethernet frames that arrive on its interfaces. A router uses a routing table to move packets between networks, while a Layer 2 switch uses its MAC table to move frames within a VLAN.

Ethernet frame fields relevant to switching

An Ethernet frame is the Layer 2 unit that a switch receives, examines, learns from, and forwards. The two frame fields most important to basic switching are:

Destination MAC address: Identifies the intended receiver or receiver group.
Source MAC address: Identifies the device that sent the frame.

Switches learn from the source MAC address, not the destination MAC address. The source address tells the switch, “this device is reachable through the interface where this frame arrived.” The destination address is then looked up in the table to decide how to send the frame.

Destination address types

Unicast: One sender to one destination. A known unicast has a matching MAC table entry in the relevant VLAN. An unknown unicast has no matching entry.
Broadcast: One sender to every device in the VLAN. The usual Ethernet broadcast address is FF:FF:FF:FF:FF:FF.
Multicast: One sender to a group of interested receivers. Basic switch behavior commonly floods multicast similarly to broadcast, although multicast-snooping features can limit forwarding to ports with interested receivers.

The initial MAC address table

A new or recently restarted switch normally has an empty, or mostly empty, dynamic MAC address table. It does not initially know which endpoint MAC address is reachable through each access port.

As devices transmit, the switch populates the table. A table can also contain manually configured static MAC entries or system-related entries before ordinary endpoint traffic is observed. Static entries are configured by an administrator and do not age out in the same way as dynamic entries.

Consider two hosts in VLAN 10:

Host A: MAC 00:00:00:00:00:0A, connected to Fa0/1
Host B: MAC 00:00:00:00:00:0B, connected to Fa0/2

Before either host sends a frame, the switch may know neither endpoint's location. The table is conceptually empty for those MAC addresses.

How source MAC learning works

The switch receives an Ethernet frame on an ingress interface.
It reads the source MAC address and identifies the VLAN associated with the frame.
It records or refreshes the source MAC-to-port association, along with VLAN and aging information.
It examines the destination MAC address within that same VLAN.
It chooses an egress action: known-unicast forwarding, same-port filtering, flooding, or multicast handling.

Learning occurs before the switch decides how to send the frame onward. If the same source MAC is later received on another interface, the switch relearns it on the new port. This is called a MAC address move. A move can be legitimate, such as a user moving a cable or a virtual machine migrating, but repeated moves may indicate a loop, incorrect cabling, or a duplicate MAC address.

The effective lookup key is not just a MAC address. It is the combination of VLAN ID and MAC address. The same MAC value could therefore appear in separate VLAN contexts, although duplicate MAC use can still cause operational problems.

Forwarding decisions after learning

After learning the source, the switch looks up the destination MAC address in the incoming VLAN. The destination lookup determines whether the switch forwards to one port, forwards to several ports, or sends nothing back through the ingress interface.

Destination type or lookup result	MAC table condition	Switch action	Eligible egress ports
Known unicast	Destination MAC exists in the incoming VLAN	Forward only toward the destination entry	The destination port, unless it is the ingress port
Unknown unicast	No destination entry exists in the incoming VLAN	Flood the frame	All eligible ports in the VLAN except ingress
Broadcast	Broadcast destination, normally `FF:FF:FF:FF:FF:FF`	Flood the frame	All eligible ports in the VLAN except ingress
Multicast	Multicast destination; handling depends on switch features	Basic behavior floods; multicast snooping may constrain forwarding	Eligible VLAN ports, or selected receiver ports with snooping
Destination known on ingress port	Destination entry points to the same interface where the frame arrived	Filter the frame and do not transmit it back out that interface	None

Known unicast forwarding

For a known unicast, the switch finds a destination entry such as VLAN 10, MAC 00:00:00:00:00:0B, port Fa0/2. It transmits the frame only through Fa0/2, rather than sending it to every VLAN 10 port.

Unknown unicast flooding

If the destination MAC is absent from the table for that VLAN, the frame is an unknown unicast. The switch floods it out all eligible ports in the VLAN except the ingress port. This allows the destination to receive the frame even though its location is not yet known. When the destination later transmits, the switch can learn its source MAC.

Broadcast flooding

A broadcast is intended for all devices in the VLAN, so the switch floods it within that VLAN, excluding the ingress port. Broadcast flooding does not cross a VLAN boundary by itself.

Multicast forwarding

Multicast is addressed to a group rather than one host or every host. At a basic level, a switch may treat multicast as traffic that should be flooded to eligible ports. With multicast snooping enabled, the switch can inspect control information and forward some multicast streams only to ports with interested receivers. The exact behavior depends on the platform, configuration, and multicast protocol.

Same-port filtering

Suppose a hub or downstream Layer 2 device connects multiple devices through one switch port. If the switch knows both the source and destination MAC addresses through that same interface, a frame arriving on that interface for the destination does not need to be sent back out the same interface. The switch filters it.

VLAN scope of MAC learning and flooding

A VLAN is a Layer 2 broadcast domain. MAC entries and destination lookups are logically scoped by VLAN. For example, these are separate logical entries:

VLAN 10, MAC 00:00:00:00:00:01, Fa0/1
VLAN 20, MAC 00:00:00:00:00:01, Fa0/5

The lookup for a frame in VLAN 10 does not use the VLAN 20 entry. Similarly, an unknown unicast or broadcast in VLAN 10 is flooded only to eligible VLAN 10 ports. It is not sent to VLAN 20 ports. Communication between VLANs requires Layer 3 forwarding, such as a router or multilayer switch. A trunk carries multiple VLANs but does not, by itself, forward traffic between them; see configuring trunk ports for trunk fundamentals.

MAC address aging and relearning

Dynamic entries have an inactivity timer called MAC aging. Aging prevents the table from retaining stale information forever. If a device is disconnected, moved, or replaced, its old port association eventually expires when no frames arrive with that source MAC address.

Receiving a frame with a dynamically learned source MAC refreshes that entry's timer. The timer is associated with inactivity, not simply with the passage of time since the entry was first created.

When an entry expires, a later frame sent to that destination becomes an unknown unicast. The switch floods it within the relevant VLAN until the destination sends a frame and is learned again.

Static entries behave differently. A manually configured static MAC entry does not age out like an ordinary dynamic entry. It remains until removed or changed, subject to platform behavior and configuration.

End-to-end learning sequence

Use Host A on Fa0/1 and Host B on Fa0/2, both in VLAN 10. Assume the dynamic table starts empty.

Frame number	Ingress port	Source MAC	Destination MAC	Learning result	Forwarding decision	MAC table after processing
First Host A to Host B frame	Fa0/1	00:00:00:00:00:0A	00:00:00:00:00:0B	Learn Host A in VLAN 10 on Fa0/1	Host B is unknown; flood to eligible VLAN 10 ports except Fa0/1	VLAN 10: Host A → Fa0/1
Host B reply	Fa0/2	00:00:00:00:00:0B	00:00:00:00:00:0A	Learn Host B in VLAN 10 on Fa0/2; refresh Host B whenever it sends again	Host A is known; forward only to Fa0/1	Host A → Fa0/1; Host B → Fa0/2
Subsequent Host A to Host B frame	Fa0/1	00:00:00:00:00:0A	00:00:00:00:00:0B	Refresh Host A's dynamic timer	Known unicast; forward only to Fa0/2	Both MAC addresses remain associated with their learned ports

The first frame may be delivered to Host B through flooding. After the reply, both endpoints are known, so later unicast traffic is forwarded directly between the two ports.

MAC address table entry types

Entry type	How created	Ages out	Typical use or behavior
Dynamic	Learned automatically from a source MAC in a received frame	Yes, after the configured inactivity period	Normal endpoint learning; refreshed when frames arrive
Static	Configured manually by an administrator	Not in the same way as dynamic entries	Fixed MAC-to-VLAN-to-interface association
System or special	Created or reserved by the switch or a feature	Platform and feature dependent	May represent system functions, special forwarding behavior, or control-related addresses

Typical table output includes the VLAN, MAC address, entry type, and interface. A dynamic entry might conceptually look like: VLAN 10, MAC 0000.0000.000A, dynamic, Fa0/1.

Inspecting the table with Cisco IOS

Use these commands on a Cisco IOS switch:

show mac address-table
show mac address-table dynamic
show mac address-table vlan 10
show mac address-table address 0000.0000.0001
show mac address-table interface fastethernet0/1

show mac address-table displays the complete table.
show mac address-table dynamic focuses on dynamically learned entries.
show mac address-table vlan 10 limits the output to VLAN 10.
show mac address-table address 0000.0000.0001 searches for one MAC address.
show mac address-table interface fastethernet0/1 shows addresses learned on one interface.

In a controlled lab, you can set the dynamic aging time with:

mac address-table aging-time 300

This example sets the switch's dynamic aging time to 300 seconds where supported by the platform and configuration mode.

A static entry can be configured with:

mac address-table static 0000.0000.0001 vlan 10 interface fastethernet0/1

During a controlled troubleshooting task or lab, dynamically learned entries can be cleared with:

clear mac address-table dynamic

Use clearing commands carefully because removing entries temporarily causes unknown unicast flooding while the switch relearns endpoints.

Operational limitations and abnormal conditions

MAC address moves

A MAC move occurs when the switch learns the same source MAC on a different port. One move can be normal: a device may have been physically relocated, a downstream switch may have been rewired, or a virtual machine may have migrated to another host.

Frequent alternation between two or more ports is more concerning. Possible causes include:

A Layer 2 loop or incorrectly connected switch.
Incorrect cabling or an endpoint moving between access ports.
A duplicate or cloned MAC address.
Virtualization mobility or a virtual host presenting multiple interfaces.
An unauthorized device using an existing address.

Repeated moves can make the table unstable. The switch may send traffic to the wrong port until the next source frame changes the entry again.

Layer 2 loops

A Layer 2 loop provides multiple paths through which frames can circulate. Broadcasts and unknown unicasts can multiply, causing excessive flooding. Source MAC addresses may repeatedly appear on different interfaces, producing unstable learning and MAC-flap messages.

Spanning Tree Protocol helps prevent switching loops by placing redundant Layer 2 paths into a non-forwarding state while maintaining a loop-free active topology. Spanning Tree is broader than MAC learning, but stable MAC learning depends on a loop-free forwarding topology.

Port security

Port security controls how many and which MAC addresses an interface may learn. It can limit an access port to a specific address or to a configured maximum and can define an action when an unexpected address appears. This helps restrict unauthorized devices, but a policy must account for legitimate phones, downstream devices, virtualization, and other sources of multiple MAC addresses.

Multiple MAC addresses behind one port

A switch learns every observed source MAC against the interface where the frame arrived. Therefore, multiple MAC addresses on one port are not automatically an error. A hub, unmanaged switch, IP phone with a connected computer, downstream switch, or virtualization host can legitimately place several devices behind one switch interface.

Troubleshooting MAC learning problems

Traffic is flooded instead of sent directly

If traffic to a local host is being flooded, the destination's dynamic entry may be absent or aged out. Other possibilities include the destination being in a different VLAN, being powered off, disconnected, or unable to transmit return traffic.

Check the destination MAC and VLAN with show mac address-table.
Confirm the access-port VLAN and link status.
Generate traffic from the destination so its source MAC can be learned again.

A MAC address appears on an unexpected interface

Verify physical connectivity, interface descriptions, and the expected device path. Inspect whether several MAC addresses appear on that interface. A downstream Layer 2 device, phone, hub, virtualization host, wrong cable, or recently moved endpoint may explain the result.

The same MAC alternates between ports

Check switch logs for MAC-flap notifications. Validate cabling and spanning-tree state, then identify which endpoint or downstream device is advertising the address. Consider a loop, duplicate MAC, unstable physical topology, or legitimate virtualization mobility.

An access port learns more addresses than expected

Display entries by interface. Inspect the connection for a hub or unmanaged switch, an unauthorized device, or a virtualized host. Apply an appropriate port-security policy when the design requires a limit.

Key points to remember

The MAC address table maps MAC addresses to VLANs and switch ports.
Source MAC learning happens when a frame enters an ingress interface.
The destination MAC is used for lookup, not for learning.
Known unicast frames are forwarded only to the destination's learned port.
A frame whose destination is known on the ingress port is filtered.
Unknown unicast, broadcast, and basic multicast flooding stay within the relevant VLAN.
Dynamic entries refresh when their source MAC is seen and expire after inactivity.
MAC moves, excessive flooding, and unexpected numbers of MAC addresses can reveal topology, cabling, virtualization, security, or loop problems.
Spanning Tree helps maintain a loop-free Layer 2 topology, while port security can limit MAC addresses learned on an interface.