Layer 2 Switching: Ethernet Frames, MAC Tables, and Cisco Verification

Learn how Layer 2 switches forward Ethernet frames, learn MAC addresses, separate collision domains, prevent loops, and troubleshoot switching issues for CCNA.

Layer 2 switching is the process of forwarding Ethernet frames inside a local area network (LAN) by using Media Access Control (MAC) addresses. A switch receives a frame on an ingress port, examines its Layer 2 information, consults its MAC address table, and sends the frame through the appropriate egress port or ports.

This lesson covers Ethernet frame handling, MAC learning, forwarding decisions, collision and broadcast domains, switching methods, duplex negotiation, loop prevention, and basic Cisco IOS verification.

Purpose of Layer 2 Switching

Layer 2 is the OSI data link layer. Ethernet uses frames at this layer, and each Ethernet interface is identified locally by a MAC address. A Layer 2 switch normally forwards frames based on destination MAC addresses rather than destination IP addresses.

Switching allows multiple devices to communicate through the same LAN infrastructure while limiting each frame to the ports that need to receive it. This improves bandwidth use compared with a hub, which repeats traffic to every port.

Hubs, bridges, switches, and routers

Device type	Primary operating layer	Forwarding basis	Collision-domain behavior	Broadcast-domain behavior
Hub	Physical layer	Repeats electrical or optical signals	All connected devices share one collision domain	Does not separate broadcasts
Layer 2 switch	Data link layer	Destination MAC address and VLAN	Normally one collision domain per port	All ports in the same VLAN share a broadcast domain
Router	Network layer	Destination IP address and routing table	Each interface is a separate Layer 2 segment	Separates broadcast domains

A bridge is an earlier form of Layer 2 device that connects LAN segments and forwards frames using MAC addresses. Modern switches perform the same basic function at higher port counts and usually in specialized hardware.

Why switches improve LAN performance

A switch can forward a known unicast frame to one destination port instead of repeating it everywhere.
Each switch port is normally an independent collision domain.
Full-duplex links allow sending and receiving at the same time without collisions.
Traffic remains within the relevant VLAN unless it is a broadcast, multicast, or unknown unicast that must be flooded.

Ethernet Frame Handling

An Ethernet frame is the Layer 2 data unit. Important fields include the destination MAC address, source MAC address, payload, and Frame Check Sequence (FCS).

Destination MAC: Identifies the intended receiving interface or group.
Source MAC: Identifies the interface that transmitted the frame and is used for MAC learning.
Payload: Carries higher-layer data, such as an ARP message or an IPv4 packet.
FCS: Provides an error-detection value. A switch using store-and-forward can discard a frame whose FCS check fails.

At a conceptual level, a switch receives a frame, checks enough information to process it, learns the source, looks up the destination, and then forwards, filters, or floods the frame.

Unicast, broadcast, and multicast

Unicast: Intended for one destination MAC address.
Broadcast: Intended for every device in the local broadcast domain. The Ethernet broadcast address is ff:ff:ff:ff:ff:ff. An ARP request is a common example.
Multicast: Intended for a subscribed group of devices. Basic Layer 2 switching may treat multicast similarly to flooding unless special multicast controls are configured.

Frame processing outcomes

Destination type or table condition	Switch action	Eligible outbound ports	Typical example
Known unicast	Forward the frame directly	Only the port mapped to the destination MAC in the same VLAN	A sends a frame to B after B has been learned
Unknown unicast	Flood the frame	All eligible ports in the VLAN except the ingress port	The destination has not yet transmitted or its entry aged out
Broadcast	Flood the frame	All eligible ports in the broadcast domain except the ingress port	ARP request
Multicast	Forward using multicast information or flood when no specific control exists	Ports eligible for that VLAN and multicast group	A multicast application stream
Destination reachable through ingress port	Filter the frame	None; do not transmit it back through the ingress port	Both source and destination MAC addresses are learned behind the same downstream port

Flooding never means sending a frame back out the port on which it arrived. The switch excludes the ingress port to avoid an unnecessary return transmission.

Example: initial MAC learning

Host A sends a frame into switch port Gi0/1. Its source MAC is 00:00:00:00:00:0a.
The switch records that source MAC as reachable through Gi0/1 in the frame's VLAN.
The switch examines the destination MAC and searches its MAC address table.
If the destination is unknown, the switch floods the frame to other eligible ports in that VLAN.

Learning happens from the source address, not the destination address. This lets the switch discover where a device is located as devices transmit.

Example: unknown unicast followed by direct forwarding

Host A sends to Host B, but the switch has no entry for B. The switch learns A and floods the frame within A's VLAN.
Host B receives the frame and replies. The switch learns B from the reply's source MAC and associates B with B's port.
Later frames from A to B match B's table entry and are sent only to B's port.

Example: broadcast handling

When a host sends an ARP request, the switch learns the sender's source MAC and floods the broadcast to active ports in the same VLAN, excluding the ingress port. A router does not forward a normal Layer 2 broadcast between its interfaces. This is why a router or Layer 3 boundary limits the broadcast domain.

MAC Address Table Operation

A MAC address table maps MAC addresses to ports and VLANs. The table is also commonly called a CAM table, named after content-addressable memory used by switching hardware. The VLAN is essential: a MAC entry is meaningful in its VLAN context.

Dynamic learning

When a frame enters an ingress port, the switch examines the source MAC address. It creates or refreshes a dynamic entry that associates the source MAC with the ingress port and VLAN.

If a device moves to another switch port, the switch can relearn the same source MAC on the new port when traffic arrives. Until that happens, an old entry may remain temporarily or traffic may be flooded.

MAC address aging

MAC address aging removes inactive dynamic entries after a configured period. Aging prevents stale locations from remaining indefinitely. After an entry ages out, traffic to that destination is treated as an unknown unicast until the switch relearns the destination.

Static and dynamic entries

Dynamic entry: Learned automatically from incoming source MAC addresses and removed or updated through aging and relearning.
Static entry: Configured by an administrator and not learned in the same automatic way. It can be useful for demonstrations or controlled forwarding, but an incorrect static entry can direct traffic to the wrong port.

Same-port filtering

Suppose two MAC addresses are learned through the same downstream port, such as a port connected to another switch. If a frame enters that port and its destination is also mapped to that port, the local switch filters the frame. Sending it back out the same port would be unnecessary and could create unwanted behavior.

Collision Domains and Broadcast Domains

A collision domain is a segment where Ethernet collisions could occur when devices use half-duplex operation. With a switch, each active port is normally a separate collision domain. With a hub, all attached devices share one collision domain.

Full duplex permits simultaneous transmission and reception. Because each direction has its own communication path, normal full-duplex Ethernet does not use collision detection in the same way as half-duplex Ethernet.

A broadcast domain is the group of devices that receives a Layer 2 broadcast. In a single VLAN, all switch ports belonging to that VLAN are part of the same broadcast domain. VLANs divide a switch into separate broadcast domains, and routers separate broadcast domains between Layer 3 interfaces.

For example, four hosts connected to a hub share one collision domain. The same four hosts connected to four separate full-duplex switch ports use four collision domains, while they may still share one broadcast domain if all ports belong to the same VLAN.

Switching Methods

Method	When forwarding begins	Error checking behavior	Latency	Key advantage	Key limitation
Store-and-forward	After the entire frame is received	Can validate the FCS and frame size before forwarding	Highest of the three	Better error handling and support for differing port speeds	Must buffer the complete frame
Cut-through	After reading enough of the header to identify the destination	May forward a damaged frame because the complete FCS has not arrived	Very low	Fast forwarding	Less opportunity to detect errors before transmission
Fragment-free	After receiving the first 64 bytes	Can avoid forwarding many collision fragments but does not perform full-frame validation first	Between store-and-forward and cut-through	Balances some error filtering with lower delay	Does not provide the full checking of store-and-forward

Modern switches commonly use store-and-forward behavior, especially where error checking and buffering are important. The choice is a tradeoff among latency, validation, and forwarding speed.

Duplex and Speed Negotiation

Auto-negotiation allows connected Ethernet interfaces to advertise and select compatible speed and duplex settings. When supported correctly on both ends, it is generally preferable to forcing one side manually.

Half duplex: An interface cannot transmit and receive simultaneously and may experience collisions.
Full duplex: An interface can transmit and receive simultaneously without normal Ethernet collisions.

A duplex mismatch occurs when one side operates as full duplex while the other behaves as half duplex. Symptoms can include poor throughput, late collisions, CRC errors, runts, retransmissions, and inconsistent connectivity. A fast link can still perform badly when the two ends disagree about duplex operation.

When manual configuration is required, configure compatible settings on both endpoints. Do not force full duplex on one side while leaving the other side to negotiate incompatible behavior.

Example configuration

The following is a troubleshooting or compatibility example, not a universal default:

interface GigabitEthernet0/10
 switchport mode access
 speed 1000
 duplex full
 no shutdown

The configured speed value must be supported by the interface and the connected device. After changing settings, verify both ends and inspect counters.

Layer 2 Loop Prevention Overview

Redundant switched links improve resilience, but multiple active Layer 2 paths can create a loop. Ethernet frames do not contain a hop count that automatically stops them after repeated circulation.

Loops can cause broadcast storms, duplicate frames, excessive multicast traffic, and MAC table instability. MAC flapping occurs when a switch repeatedly sees the same source MAC address arriving on different ports, often because frames are circulating through a loop or a device is moving between ports.

Spanning Tree Protocol (STP) prevents forwarding loops by calculating a loop-free logical topology. STP allows some physical redundancy while placing selected ports into a non-forwarding or blocked state. If the active path fails, an alternate path can become forwarding after the protocol reconverges.

Use STP verification to understand which ports are forwarding, which are alternate or blocked, and which switch is acting as the root for a VLAN.

Basic Cisco Switch Verification and Management

View learned MAC addresses

show mac address-table
show mac address-table dynamic
show mac address-table address <mac-address>

Read the output as follows:

VLAN: The broadcast and forwarding context for the entry.
MAC address: The learned or configured Layer 2 address.
Type: Usually dynamic or static.
Ports: The interface associated with the MAC address.

Verify interface state and counters

show interfaces status
show interfaces <interface>
show interfaces counters errors

Check whether the link is connected, the VLAN or port mode is appropriate, and the negotiated speed and duplex match expectations. Detailed interface output may show CRC errors, collisions, late collisions, input errors, output drops, and other counters.

Verify VLAN context

show vlan brief
show interfaces <interface> switchport

MAC learning, forwarding, and flooding are scoped to a VLAN. A correct MAC address on the wrong VLAN does not provide the expected local connectivity.

Configure a demonstration static MAC entry

mac address-table static <mac-address> vlan <vlan-id> interface <interface>

Remove a test entry using the corresponding Cisco IOS removal form:

no mac address-table static <mac-address> vlan <vlan-id> interface <interface>

Static entries should be used deliberately. A stale static entry can prevent normal relearning when a device changes ports.

Verify spanning tree

show spanning-tree
show spanning-tree vlan <vlan-id>

Use this output to relate redundant paths to forwarding and blocked port states. STP details are covered further in a dedicated spanning-tree lesson.

Troubleshooting Layer 2 Problems

Symptom	Likely Layer 2 cause	Verification approach	Typical corrective action
Slow or inconsistent connectivity	Duplex mismatch, errors, congestion, or an unstable path	Inspect interface status, speed, duplex, and counters	Correct compatible settings, cabling, VLAN membership, or the affected interface
High interface errors	Damaged cable or transceiver, duplex mismatch, or physical fault	Check CRC errors, late collisions, runts, drops, and both endpoint settings	Repair or replace the physical component and make settings compatible
Unknown destination unreachable	Destination disconnected, wrong VLAN, stale static entry, or no return traffic	Search the MAC table, check link state, and verify switchport VLAN settings	Correct the port or VLAN, remove an incorrect static entry, and generate traffic for relearning
Broadcast storm behavior	Layer 2 loop or malfunctioning switching equipment	Check STP, traffic levels, redundant links, and port roles	Restore loop prevention or remove the unintended redundant path
MAC address flapping	Forwarding loop, endpoint movement, or incorrectly connected equipment	Observe whether the MAC appears on multiple ports and inspect STP	Correct the topology or loop condition and confirm stable learning

Host moved to a different switch port

If a host cannot communicate after being moved, first check whether the new interface is up and assigned to the correct VLAN. Then search for the host MAC address in the table. A static entry may still point to the old port, or the switch may not have received traffic from the host on its new port. Correct the port or VLAN, remove an incorrect static entry, and generate traffic so the switch can learn the new location.

Poor performance after connecting a device

Inspect both ends of the link for speed and duplex compatibility. Look for CRC errors, late collisions, runts, and excessive drops. Also inspect the cable or transceiver. Correct the physical problem or use consistent auto-negotiation where supported, then recheck counters after traffic resumes.

Instability after adding a redundant link

Check STP state and port roles, watch for rapidly changing MAC entries, and look for unusually high broadcast or multicast traffic. Restore loop prevention or temporarily remove the redundant path while correcting the topology.

Repeated flooding for a local device

Search for the destination MAC address. The entry may have aged out because the device has been quiet, the device may be disconnected, or it may be in another VLAN. If the entry repeatedly appears on different ports, investigate a loop or device movement.

Exam-Relevant Notes

A switch learns the source MAC address on the ingress port before making its forwarding decision.
Known unicast traffic is sent to one destination port in the correct VLAN.
Unknown unicast and broadcast traffic are flooded to eligible ports except the ingress port.
A switch filters a frame when the destination is mapped to the same port on which the frame arrived.
Each switch port is a separate collision domain, but ports in one VLAN remain in the same broadcast domain.
Routers and VLAN boundaries separate broadcast domains.
Full-duplex Ethernet eliminates normal collisions; duplex mismatches produce errors and poor performance.
Store-and-forward receives and checks the complete frame before forwarding.
STP prevents forwarding loops by blocking selected redundant paths.
MAC address tables are VLAN-specific, and dynamic entries can age out or move when traffic reveals a new location.