How Ethernet Switches Learn MAC Addresses

Learn how Ethernet switches build MAC address tables from source MAC addresses, forward known unicasts, flood unknown traffic, age entries, and verify behavior with Cisco IOS.

What a Switch Learns

An Ethernet switch connects devices within a local-area network (LAN). To decide where to send Ethernet frames, it builds a table that associates device addresses with switch interfaces. This process is called MAC address learning.

A switch does not need to know every device in advance. It learns from frames as they arrive, then uses the learned information to make forwarding decisions.

MAC Addresses in Ethernet LANs

A Media Access Control (MAC) address is a Layer 2 hardware identifier used in Ethernet communication. A network interface, such as an Ethernet port or network adapter, uses a MAC address as an endpoint identifier on a local Ethernet network.

An Ethernet frame contains at least two important MAC address fields:

Source MAC address: identifies the interface that sent the frame.
Destination MAC address: identifies the intended receiving interface or group of interfaces.

MAC addresses support local delivery between devices on the same Ethernet segment or within the same VLAN. A VLAN is a Layer 2 broadcast domain. Switch learning and flooding are scoped to the relevant VLAN, so the same MAC address can be associated with different VLAN contexts.

The MAC Address Table

A switch stores learned Layer 2 information in a MAC address table. This table is also called a forwarding database (FDB) or, on many switches, a CAM table. CAM refers to content-addressable memory, hardware that can perform fast address lookups.

A dynamic table entry effectively maps a MAC address and VLAN to the switch interface where that source MAC address was last observed:

MAC address + VLAN  ->  switch interface

The incoming interface is the ingress port. An interface used to transmit a frame is an egress port. For example, an entry might mean that a switch last saw a particular MAC address as a frame source on VLAN 10 through FastEthernet0/1.

Field	Meaning
MAC address	The learned Layer 2 address
VLAN	The Layer 2 broadcast domain in which the address was learned
Interface	The ingress port where the source address was observed
Type	Usually dynamic or static

How Dynamic MAC Learning Works

The switch starts with no dynamic MAC entries after power-on or a restart.
An Ethernet frame arrives on a switch port.
The switch examines the frame's source MAC address.
The switch records the source MAC address with the frame's VLAN and ingress port.
The switch examines the destination MAC address to choose a forwarding action.

If a source MAC address is already in the table and a new frame with that source arrives on the same port, the switch refreshes the entry. If the same source MAC later arrives on a different port, the switch updates the entry to the new port. This is called a MAC move.

Forwarding Decisions After Learning

After learning the source address, the switch looks up the destination MAC address in the table for the relevant VLAN.

Destination condition	Switch action	Eligible egress ports
Known unicast on a different port	Forward only to the interface mapped to the destination MAC	The mapped port, if it is reachable in the same VLAN
Known destination mapped to the ingress port	Filter the frame	None; do not send it back through the receiving port
Unknown unicast	Flood the frame	All other eligible ports in the VLAN
Broadcast	Flood the frame	Applicable ports in the VLAN, except the ingress port
Most multicast traffic	Forward according to normal multicast and switch feature behavior	Applicable ports, subject to VLAN and multicast features

Known Unicast

A known unicast is a frame whose destination MAC address appears in the table for the relevant VLAN. The switch sends the frame only through the mapped destination interface. This avoids sending the frame to unrelated ports.

Filtering

Filtering means not transmitting a frame where transmission is unnecessary or invalid. For example, if the destination MAC is mapped to the same interface on which the frame arrived, the switch does not send the frame back out that interface.

Unknown-Unicast Flooding

An unknown unicast is a frame whose destination MAC address is absent from the table for that VLAN. The switch floods it out all other eligible ports in the VLAN. The ingress port is excluded, because sending the frame back where it arrived is unnecessary.

Broadcast frames are also distributed to applicable ports in the VLAN. Most multicast traffic is handled similarly unless features such as multicast filtering or snooping change the eligible port set.

Two-Host Learning Example

Consider this topology. Host A and Host B are in the same VLAN:

Host A ---- SW1 Fa0/1       SW1 Fa0/2 ---- Host B

At the beginning, SW1 has no dynamic entries for these hosts.

Stage	Learned MAC address	VLAN	Interface	Type	Reason
Initial state	None	-	-	-	No frames have been received from the hosts
After Host A's first frame	Host A MAC	Host VLAN	Fa0/1	Dynamic	SW1 received a frame sourced by Host A on Fa0/1
After Host B's reply	Host A MAC	Host VLAN	Fa0/1	Dynamic	Host A continues to be associated with Fa0/1
After Host B's reply	Host B MAC	Host VLAN	Fa0/2	Dynamic	SW1 received a frame sourced by Host B on Fa0/2

1. Host A Sends the First Frame

Host A sends an Ethernet frame with the following fields:

Source MAC:      Host A's MAC address
Destination MAC: Host B's MAC address

SW1 receives the frame on Fa0/1. Before deciding what to do with the destination, it learns Host A's MAC address on Fa0/1.

Host B's MAC address is not yet in the table, so the destination is an unknown unicast. SW1 floods the frame out eligible ports in the same VLAN, including Fa0/2, but not back out Fa0/1.

2. Host B Replies

Host B receives the frame and sends a reply. The reply arrives on Fa0/2 with Host B's MAC address as its source. SW1 learns Host B's MAC address on Fa0/2.

SW1 then looks up Host A's destination MAC address. Host A is already known on Fa0/1, so the reply is sent only out Fa0/1. The response is a known-unicast frame.

3. Later Traffic Is Selective

When Host A sends another frame to Host B, SW1 refreshes Host A's dynamic entry and looks up Host B's MAC address. Because Host B is mapped to Fa0/2, SW1 sends the frame only out Fa0/2.

Traffic in the reverse direction is handled similarly: frames from Host B enter Fa0/2 and are forwarded only to Fa0/1 when Host A is known.

Dynamic and Static MAC Entries

A dynamic MAC entry is created automatically from received source traffic. It is stored in runtime, volatile memory. Volatile memory is memory whose contents are lost when the switch restarts. The switch must relearn dynamic entries from subsequent frames.

A static MAC entry is manually configured by an administrator. It specifies where a MAC address is expected and can support simple forwarding control or security policies. Static entries are intended to persist in the switch configuration when the configuration is saved.

Characteristic	Dynamic entry	Static entry
How created	Automatically from a source MAC in a received frame	Manually configured
Aging	Can be removed after inactivity	Normally does not age like a dynamic entry
After reboot	Runtime entry disappears and must be relearned	Can return if configured and saved
Typical use	Normal endpoint learning	Predictable placement or forwarding and security control
Administrative control	Indirect; determined by received traffic	Directly controlled by configuration

MAC Address Aging

MAC aging is the automatic removal of an inactive dynamic entry after a configured timer expires. Aging prevents an old location from remaining indefinitely after a device is unplugged, moved, or replaced.

New traffic refreshes a dynamic entry because the switch sees the source MAC again. If a host remains silent longer than the aging interval, its entry can be removed. The next frame sent to that host may be flooded until the host transmits and is learned again.

Static entries are treated differently. They are administrator-defined and generally do not age out as dynamic entries do. Their persistence depends on the configuration being saved and supported by the platform.

Verifying MAC Learning on Cisco IOS

Use the following commands to inspect the table on a Cisco IOS switch:

show mac address-table

This displays MAC addresses, VLANs, entry types, and associated interfaces. Dynamic entries identify addresses learned automatically; static entries identify manually configured associations.

show mac address-table dynamic

This limits the output to dynamically learned entries, which is useful during a learning demonstration.

show mac address-table interface fastethernet 0/1

This filters the table by interface. Use the interface naming format supported by the switch, such as GigabitEthernet1/0/1.

To clear dynamic entries for a controlled lab test, use:

clear mac address-table dynamic

After clearing the table, generate traffic and inspect the output again to watch entries reappear. Use this command cautiously in production because unknown destinations can temporarily cause additional flooding.

Example Static Entry

mac address-table static 0000.0000.0001 vlan 10 interface fastethernet 0/1

The MAC address, VLAN, and interface in this example are placeholders. Exact syntax and supported options vary by Cisco IOS platform and release.

Example Aging Configuration

mac address-table aging-time 300 vlan 10

This example requests a 300-second aging interval for VLAN 10. Platform support and syntax can vary, so understand the operational effect before changing the timer.

Troubleshooting MAC Learning

A Host MAC Address Does Not Appear

The host may not have sent a frame since the table was cleared or the switch restarted.
The host may be powered off, disconnected, or connected through another path.
The switch port may be down or assigned to an unexpected VLAN.

Generate traffic from the host, such as a ping to another reachable device. Then check interface status and inspect the MAC table for the expected VLAN and port. Remember that a switch learns only when it receives a frame containing the address as the source.

Traffic Is Flooded Instead of Sent to One Port

The destination MAC may not have been learned.
The destination's dynamic entry may have aged out.
The destination may be in a different VLAN, or the expected VLAN may not be carried across an inter-switch link.

Check for the destination MAC in the correct VLAN. Verify VLAN membership and trunk operation where applicable. Cause the destination host to transmit, then confirm that its MAC appears in the table.

The Same MAC Appears on Different Ports

A device may have been physically moved.
A virtual machine may have migrated or changed its network attachment.
A Layer 2 loop or unauthorized device may be causing the same source MAC to appear on multiple ports.

Check the table repeatedly and compare the reported interfaces. Inspect cabling, virtual switching, and spanning-tree status. Unexpected MAC movement can indicate a loop or a security problem.

A Learned Entry Disappears After Reboot

The entry was probably dynamic and existed only in runtime memory. If persistence is expected, determine whether the entry is static and whether the configuration was saved. Dynamic entries are normally relearned when endpoints send traffic after the restart.

Exam-Relevant Summary

A switch learns a MAC address from the source MAC of an arriving frame.
The learned association includes the MAC address, VLAN, and ingress interface.
The switch uses the destination MAC to decide whether to forward, filter, or flood.
A known unicast is sent only to the mapped destination port in the relevant VLAN.
An unknown unicast is flooded to eligible ports in the VLAN except the ingress port.
Broadcast and most multicast frames are distributed according to VLAN and switch features.
If the same source MAC arrives on another port, a dynamic entry moves to that port.
Dynamic entries can age out and disappear after a reboot; static entries are manually configured and can persist when saved.
VLAN context matters: a MAC table lookup is not just a global MAC-to-port lookup.

For related study, review how switches learn MAC addresses alongside VLAN behavior, Layer 2 forwarding, ARP, port security, and Spanning Tree Protocol.