VMware ESXi and vSphere Cluster Management

How Ethernet Switches Learn MAC Addresses and Forward Frames

Learn how Ethernet switches build MAC address tables, forward known unicasts, flood unknown unicasts, filter frames, and apply VLAN boundaries.

An Ethernet switch connects devices inside a local area network (LAN). It receives Ethernet frames and makes Layer 2 forwarding decisions using MAC addresses and VLAN information.

A MAC address is a Layer 2 address that identifies an Ethernet interface. An Ethernet frame is the Layer 2 data unit that carries, among other fields, a source MAC address and a destination MAC address.

Purpose of Layer 2 switching

Layer 2 switching allows devices in the same VLAN to communicate efficiently. When a frame arrives, the switch examines its Ethernet header and selects the appropriate outgoing interface rather than sending every frame to every port.

A switch and a router operate at different layers:

• An Ethernet switch is primarily a Layer 2 device. It forwards Ethernet frames using destination MAC addresses and VLAN membership.
• A router is a Layer 3 device. It forwards IP packets between different IP networks, often between different VLANs.

Switching decisions are made separately within each VLAN. A VLAN is a logical Layer 2 broadcast domain. A frame in VLAN 10 is not normally forwarded or flooded into ports belonging to VLAN 20. Communication between VLANs requires Layer 3 routing, such as a router or a multilayer switch.

Ethernet frame fields used by a switch

The two most important Ethernet fields for basic switching are:

• Source MAC address: the MAC address of the interface that transmitted the frame. The switch uses this address to learn where the sender is connected.
• Destination MAC address: the MAC address of the intended receiver. The switch looks up this address to select forwarding, flooding, or filtering behavior.

The switch also considers the VLAN associated with the ingress port or frame. A MAC address learned in one VLAN is not automatically a valid destination entry for another VLAN.

The MAC address table

The MAC address table maps learned MAC addresses to switch interfaces and VLANs. It is also commonly called the CAM table. CAM refers to content-addressable memory, a type of memory that supports fast lookups.

A typical entry includes:

• VLAN identifier
• MAC address
• Entry type, such as dynamic or static
• Switch interface, also called the learned or outgoing interface

Entries can be created in several ways:

• Dynamic entries are learned automatically from received source MAC addresses.
• Static entries are manually configured or installed by a policy.
• Port-security entries can be learned or configured as allowed MAC addresses by the port-security feature.

Port security is an additional control mechanism, not the normal reason a switch learns ordinary dynamic MAC addresses.

How MAC address learning works

When a frame enters a switch, the receiving interface is called the ingress port. The interface through which a frame leaves is called an egress port.

1. The switch receives the frame on an ingress port.
2. It identifies the VLAN in which the frame was received.
3. It inspects the source MAC address.
4. It associates that source MAC address with the ingress port and the current VLAN.
5. It looks up the destination MAC address in the MAC table for that same VLAN.
6. It forwards, floods, or filters the frame based on the lookup result.

Source learning occurs before the destination forwarding decision and applies to every eligible received frame. This means a frame can teach the switch about its sender even when the destination is unknown.

Adding, refreshing, and moving entries

• If the source MAC address is not in the table, the switch adds a dynamic entry.
• If the source MAC address is already associated with the ingress port, the switch refreshes the entry's activity timer.
• If the same source MAC address is later received on another port, the switch updates the association to the new port. This can happen when a device is moved, or it can indicate a downstream topology change, loop, or duplicate MAC address.

MAC aging is the timed removal of inactive dynamic entries. If a device stops transmitting for long enough, its learned entry eventually expires. The next frame sent to that device may then be treated as an unknown unicast until the switch learns the destination again. Aging prevents stale information from remaining in the table indefinitely.

Forwarding decisions

After learning the source address, the switch examines the destination address in the context of the frame's VLAN.

Known unicast forwarding

A known unicast is a unicast frame whose destination MAC address has a matching entry in the MAC address table for the current VLAN.

For a known destination on another port, the switch transmits the frame only through the interface associated with that destination MAC address. It does not send the frame through every active port.

Host A -- Fa0/1       Fa0/2 -- Host B
                         Switch
Host C -- Fa0/3       Fa0/4 -- Host D

Known destination: Host B MAC -> Fa0/2
Frame path: Host A -> Fa0/1 -> Fa0/2 -> Host B
No copy is sent to Fa0/3 or Fa0/4.

Known-unicast forwarding reduces unnecessary traffic and limits the frame to the path needed by the destination.

Filtering

Filtering means that the switch does not transmit a frame through an interface where it does not need to go. Sending a known unicast through one correct egress port inherently filters it from the other ports.

Same-port filtering

If the destination MAC address is learned on the same port on which the frame arrived, the switch filters the frame instead of sending it back out that port. This can occur when two devices are reachable behind a downstream switch or hub connected to one interface.

Device X and Device Y -- Fa0/1 -- Switch

Destination MAC for Device Y -> Fa0/1
Frame arrives on Fa0/1
Frame is not transmitted back through Fa0/1

The downstream device or hub is responsible for delivering the frame to the destination on its local segment.

Unknown unicast flooding

An unknown unicast is a unicast frame whose destination MAC address is absent from the MAC address table for that VLAN. The switch knows the frame is intended for one device, but it does not yet know which port leads to that device.

The switch floods the frame through all eligible forwarding ports in the same VLAN except the ingress port. Flooding normally does not use ports that are blocked or otherwise non-forwarding by Spanning Tree Protocol (STP).

Host A -- Fa0/1       Fa0/2 -- Host B
                         Switch
Host C -- Fa0/3       Fa0/4 -- Host D

Destination MAC is absent from the VLAN's table.
Copies leave Fa0/2, Fa0/3, and Fa0/4.
No copy returns through Fa0/1.

All devices that receive the flooded frame inspect the destination MAC address. The intended host accepts the frame. Other hosts discard it because the destination MAC does not identify them. Flooding therefore creates extra Layer 2 traffic, but it allows delivery before the switch knows the destination's location.

Learning from the response

When the intended host responds, its reply enters the switch through that host's port. The switch uses the reply's source MAC address to learn the host's location. Later frames addressed to that MAC become known unicasts and are sent only through the learned egress port.

Broadcast and multicast handling

Broadcast and unknown unicast flooding are related but not identical.

• A broadcast frame is intentionally addressed to every device in the VLAN. Its destination MAC address is typically FF:FF:FF:FF:FF:FF.
• An unknown unicast frame is addressed to one specific MAC address, but the switch does not yet know where that MAC is located.

The switch floods a broadcast within the VLAN, except through the receiving port, subject to port state and other forwarding rules. Broadcast traffic does not cross VLAN boundaries without Layer 3 routing.

Multicast behavior depends on switch capabilities and configuration. Without multicast optimization, a switch may flood multicast traffic within the VLAN. Features such as IGMP snooping allow a switch to identify ports with interested receivers and limit multicast forwarding to those ports.

Step-by-step communication example

Topology

Host A -- Fa0/1       Fa0/2 -- Host B
                         Switch
Host C -- Fa0/3       Fa0/4 -- Host D

All four ports are in VLAN 10.

Known-unicast scenario

Assume the table already contains these entries:

1. Host A sends a frame addressed to Host B.
2. The switch receives it on Fa0/1.
3. The switch learns or refreshes Host A's MAC address on Fa0/1 in VLAN 10.
4. The switch finds Host B's MAC address on Fa0/2 in VLAN 10.
5. The switch transmits the frame only through Fa0/2.
6. Hosts C and D do not receive this unicast frame.

Unknown-unicast scenario

Now assume Host B's MAC address is absent from the VLAN 10 table:

1. Host A sends a unicast frame to Host B's MAC address.
2. The switch learns or refreshes Host A's source MAC on Fa0/1.
3. The destination lookup in VLAN 10 finds no entry for Host B.
4. The switch floods the frame to Fa0/2, Fa0/3, and Fa0/4, but not back to Fa0/1.
5. Host B accepts the frame. Hosts C and D discard it because they are not the destination.
6. Host B sends a reply, which enters the switch on Fa0/2.
7. The switch learns Host B's source MAC on Fa0/2.
8. Future frames from Host A to Host B are sent only to Fa0/2.

After the reply, the table includes:

VLAN boundaries and lookup scope

MAC table entries are associated with both a MAC address and a VLAN. The same MAC address could theoretically appear in different VLAN contexts, and a lookup in VLAN 10 does not use an entry learned in VLAN 20.

For a frame received in VLAN 10:

• The destination lookup is performed in VLAN 10.
• Known-unicast forwarding can select only an eligible VLAN 10 interface.
• Unknown-unicast and broadcast flooding includes only eligible forwarding ports in VLAN 10.
• Ports assigned to VLAN 20 are not egress ports for that frame.

This separation is why VLANs create separate broadcast domains. To communicate between VLANs, hosts need Layer 3 routing.

Known unicast, unknown unicast, and broadcast compared

Operational verification on Cisco IOS

Use the MAC address table commands to verify what the switch has learned:

show mac address-table
show mac address-table dynamic
show mac address-table interface fastethernet 0/2
show mac address-table vlan 10

Use the output to correlate a MAC address with its VLAN and learned interface. Exact command syntax can vary across Cisco platforms and IOS versions.

For a controlled lab test, clear dynamic entries and then generate traffic:

clear mac address-table dynamic
clear mac address-table dynamic interface fastethernet 0/2

After clearing entries, destinations may be treated as unknown unicasts until the switch relearns them. Use caution in production because clearing entries can temporarily increase flooding.

Verify the conditions that determine whether a port can participate in forwarding:

show interfaces status
show vlan brief
show spanning-tree vlan 10

A port generally must be operational, associated with the relevant VLAN, and in a forwarding state. A disabled, disconnected, incorrectly assigned, or STP-blocked port is not an ordinary eligible egress.

Relationship to port security

Port security controls which MAC addresses may use a switch port. It can limit the number of allowed addresses, learn addresses as sticky entries, or use statically specified addresses.

interface fastethernet 0/2
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky

Useful verification commands include:

show port-security interface fastethernet 0/2
show port-security address

A port-security violation can restrict traffic even when ordinary MAC learning and destination lookup would otherwise permit forwarding. Port-security defaults and options vary by platform, so verify the device documentation and lab behavior.

Troubleshooting switching behavior

Traffic is flooded instead of sent as a known unicast

• The destination has not transmitted recently, so its dynamic entry may have aged out.
• The destination MAC was learned in a different VLAN.
• The destination host is disconnected, inactive, or connected through an unexpected path.
• The table was cleared or the switch restarted.

Inspect the destination MAC and VLAN, generate traffic from the destination host, and verify interface status and VLAN assignment.

A MAC address appears on an unexpected port

• The device may have moved to another port.
• A downstream switch, hub, wireless access point, or virtualized host may be behind the learned port.
• The same MAC address may be appearing from multiple locations.

Search the MAC table by address and interface. Trace the physical topology downstream. Repeated movement of one MAC between ports may indicate a loop, a misconfiguration, or a duplicate address.

The destination MAC is learned, but communication still fails

• The ports may belong to different VLANs.
• The egress port may be down or blocked from forwarding.
• Port security may have restricted the port.
• The problem may be above Layer 2, such as incorrect IP addressing, ARP behavior, a host firewall, or an application failure.

Check VLAN membership, interface status, spanning-tree state, and port-security status before investigating Layer 3 and application behavior.

There is a large amount of unknown-unicast flooding

• Many endpoints may be inactive and their entries may have aged out.
• The platform may be approaching a MAC table capacity limit.
• A topology change, link flap, switch restart, or table-clearing event may have occurred.
• Traffic may be addressed to invalid or unreachable destination MAC addresses.

Review MAC table size, interface errors, topology events, and endpoint return traffic. Short-lived flooding during learning can be normal; persistent flooding requires investigation.

Decision process summary

1. Receive the Ethernet frame on the ingress port.
2. Identify the frame's VLAN context.
3. Learn or refresh the source MAC address on that ingress port and VLAN.
4. Determine whether the destination is broadcast, multicast, or unicast.
5. For a known unicast, forward only to the learned destination interface.
6. If the destination maps to the ingress port, filter the frame.
7. For an unknown unicast, flood through eligible same-VLAN forwarding ports except the ingress port.
8. For a broadcast, flood within the VLAN except the ingress port.
9. For multicast, use the platform's configured multicast behavior, such as IGMP snooping when available.

For a visual review of the forwarding process, see how switches forward frames.