CCNA online course

What Is a Network Switch? Functions, MAC Tables, and Frame Forwarding

Learn how Ethernet network switches connect LAN devices, learn MAC addresses, build forwarding tables, and selectively forward, filter, or flood frames.

A network switch is a device that connects endpoints and other network devices within a local-area network (LAN). A LAN is a local network environment where devices communicate over connected Ethernet links.

A switch receives an Ethernet frame on one interface, examines its destination information, and sends the frame toward the intended destination. Unlike a hub, it does not normally repeat every frame out every port. Unlike a router, a typical Layer 2 switch does not use IP routes to move traffic between separate networks.

For background, review the OSI reference model and basic unicast, multicast, and broadcast addresses.

What Does a Network Switch Do?

In a small LAN, computers, printers, access points, servers, and other devices connect to switch ports. Each device sends and receives Ethernet frames, the Layer 2 units used for Ethernet communication.

When a frame arrives, the switch:

• Receives the frame on an ingress port.
• Learns the source MAC address from the frame.
• Looks up the destination MAC address in its forwarding information.
• Forwards, filters, or floods the frame according to the lookup result.

A MAC address is a Layer 2 address associated with a network interface. It identifies an interface within the local Ethernet forwarding domain. A typical switch makes its ordinary forwarding decision using MAC addresses, not IP addresses.

A Switch Is a Multiport Bridge

An Ethernet bridge is a Layer 2 device that connects LAN segments and filters traffic using MAC addresses. A modern switch is essentially a high-port-density, high-performance implementation of bridging functions.

Traditional bridges commonly connected a small number of segments. Switches perform the same basic MAC-based filtering across many ports and commonly add hardware forwarding, VLAN support, redundancy features, security controls, and management capabilities.

• Bridge: Connects and filters between a small number of LAN segments.
• Switch: Provides multiport bridging with a separate forwarding interface for each connected port.

Where a Switch Operates in the OSI Model

A typical Ethernet switch operates at OSI Layer 2, the Data Link layer. Ethernet framing and MAC-based forwarding are Data Link functions. The OSI reference model explains how this layer relates to the other layers.

The source and destination MAC addresses are fields in an Ethernet frame. The destination MAC address is the key field used for ordinary Layer 2 forwarding. The switch does not need to inspect the destination IP address to send a normal frame within a VLAN.

A multilayer switch can also perform Layer 3 routing. It continues to perform standard Layer 2 switching, but when configured with Layer 3 interfaces and routing information, it can route between IP networks or VLANs.

Ethernet Frames and MAC Addresses

An Ethernet frame includes, among other fields, a source MAC address and a destination MAC address.

• Source MAC: Identifies the transmitting network interface.
• Destination MAC: Identifies the intended receiving interface or destination group.

For a known unicast frame, the switch uses the destination MAC address to select an output port. MAC addresses are meaningful within the Layer 2 forwarding domain. IP addresses, by contrast, support Layer 3 communication between networks.

The MAC Address Table

The switch keeps a MAC address table, also called a CAM table or forwarding table. It maps learned MAC addresses to switch ports. In a practical switch, the VLAN is part of the context, because the same MAC address can be considered separately in different VLANs.

The table is learned dynamically. When a frame arrives, the switch examines its source MAC address and associates that address with the ingress port and VLAN. If the mapping already exists, the switch refreshes it. If the device moves and begins transmitting through another port, the switch can update the mapping to the new port.

Dynamic entries have an aging timer. If the switch does not see traffic from a learned source for the aging period, it removes the entry. Aging allows the table to adapt to powered-off devices, moved devices, and topology changes.

Viewing the Table on Cisco IOS

show mac address-table
show mac address-table dynamic
show mac address-table interface GigabitEthernet1/0/1

How a Switch Forwards a Frame

The forwarding process follows a consistent sequence:

1. The switch receives a frame on an ingress interface.
2. It learns or refreshes the source-MAC-to-port mapping in the appropriate VLAN.
3. It inspects the destination MAC address.
4. It searches the MAC address table.
5. It selects an action: forward, filter, or flood.

Known-Unicast Forwarding Example

Assume Host A, Host B, and Host C connect to three separate ports. The switch has learned Host C's MAC address on Host C's port. Host A sends a frame addressed to Host C.

1. The switch learns or refreshes Host A's source MAC address on Host A's port.
2. It finds Host C's destination MAC address in the MAC table.
3. Because Host C is on a different port, the switch sends the frame only through Host C's port.
4. Host B does not receive that known-unicast frame.

Unknown-Unicast Flooding Example

Suppose the MAC table is empty and Host A sends a frame to Host C. The switch learns Host A's source MAC address, but it cannot find Host C's destination MAC address. It therefore floods the frame out all eligible ports in the same VLAN except the ingress port. Host C can receive the frame and reply. The reply teaches the switch Host C's MAC-to-port mapping, so later frames from Host A to Host C can be forwarded selectively.

Filtering on the Ingress Port

If the destination MAC is already mapped to the same port on which the frame arrived, sending the frame back out that port is unnecessary. The switch filters the frame instead. This can occur when both source and destination are reachable through the same logical or physical port, such as behind another connected device.

Collision Domains and Full-Duplex Ethernet

A collision domain is a network segment in which simultaneous Ethernet transmissions could collide. Each physical switch port is normally its own collision domain. Traffic on one switch port does not contend for the same collision domain as traffic on another port.

A hub behaves differently. It repeats incoming electrical signals to all ports, so all devices connected to the hub share one collision domain.

In full-duplex Ethernet, both ends of a link can transmit and receive at the same time. A correctly configured full-duplex switched link should not experience Ethernet collisions. Speed and duplex settings should match at both ends, or both sides should use reliable autonegotiation.

Duplex mismatches can produce poor performance, errors, retransmissions, and late collisions. Check the negotiated settings and interface counters when these symptoms occur.

show interfaces GigabitEthernet1/0/1
show interfaces status

Hub, Bridge, Switch, and Router Compared

VLANs and the Limits of Layer 2 Switching

A VLAN is a logical Layer 2 network and broadcast-domain boundary on a switch. A Layer 2 switch normally forwards frames only within the same VLAN. An unknown unicast or broadcast in VLAN 10 is not flooded into VLAN 20.

Communication between VLANs requires Layer 3 routing. The routing function can be provided by a router or a multilayer switch. A router-on-a-stick design uses a trunk link and router subinterfaces; see configure trunk ports and configure router on a stick for related configuration concepts.

Basic Cisco IOS Access-Port Example

configure terminal
interface GigabitEthernet1/0/1
switchport mode access
switchport access vlan 10
no shutdown
end

This configuration places the host-facing interface in VLAN 10. It does not by itself provide routing between VLAN 10 and another VLAN.

Preventing Layer 2 Switching Loops

Redundant switch links improve availability, but they can create Layer 2 loops. Frames may circulate repeatedly, MAC addresses may appear to move between ports, and broadcasts can multiply rapidly.

Spanning Tree Protocol (STP) is the foundational Layer 2 mechanism for preventing such loops. It logically blocks selected redundant paths while keeping them available for failover.

Troubleshooting Switch Behavior

A Host Was Moved to a Different Switch Port

If a host cannot reach another local host after being moved, the old dynamic MAC entry may not have aged out yet. Other possibilities include a down link, an incorrect access VLAN, a bad cable, or an endpoint NIC that is not transmitting.

• Check the interface link status.
• Verify the port's access VLAN.
• Inspect the MAC table for the host MAC and learned port.
• Generate traffic from the moved host and confirm that the switch learns the MAC on the new port.

Traffic Is Being Flooded

A switch floods traffic when the destination MAC is unknown, not necessarily because the switch is malfunctioning. The destination device may be powered off, may not yet have transmitted, may be in another VLAN, or its entry may have aged out.

• Review the dynamic MAC table for the destination MAC.
• Verify the destination port state and VLAN membership.
• Confirm that the destination endpoint can transmit traffic back toward the switch.

Slow Performance or Duplex Errors

• Review negotiated speed, duplex, and interface error counters.
• Use compatible autonegotiation settings, or explicitly match both ends when forced settings are required.
• Test or replace the cable, transceiver, or other physical component.

Devices in Different VLANs Cannot Communicate

This is expected when no Layer 3 gateway is configured. Verify access-port VLAN assignments, host IP addresses, and default gateways. Then confirm that a router or multilayer switch is configured for inter-VLAN routing.

Exam-Relevant Summary

• A typical Ethernet switch is a Layer 2, Data Link layer device.
• It is a multiport bridge that forwards frames using destination MAC addresses.
• Dynamic MAC learning records source MAC addresses against ingress ports and VLANs.
• Known unicast traffic is sent only to the destination port.
• A frame whose destination is mapped to the ingress port is filtered.
• Unknown unicast and broadcast traffic are flooded within the same VLAN, excluding the ingress port.
• Multicast may be flooded by default; IGMP snooping can optimize delivery.
• Each switch port is normally a separate collision domain, and full-duplex links do not expect collisions.
• Layer 2 switching does not route between VLANs; inter-VLAN communication requires Layer 3 routing.
• STP prevents redundant Layer 2 paths from forming active switching loops.