VMware ESXi and vSphere Cluster Management

Layer 2 Switching: MAC Learning, Frame Forwarding, and Loop Prevention

Learn how Layer 2 Ethernet switches learn MAC addresses, forward frames, handle flooding, separate collision domains, and prevent loops with STP.

What Is Layer 2 Switching?

Layer 2 switching is the process of forwarding Ethernet frames within a local-area network (LAN) by using hardware addresses called MAC addresses. It operates at the OSI Data Link layer, also called Layer 2.

The Data Link layer provides local delivery, framing, and hardware addressing. A switch examines the Ethernet frame header, learns where devices are located, and selects an appropriate outgoing port.

A switch normally makes its forwarding decision from the destination MAC address, not from an IP address and not from a routing table. An Ethernet frame is the Layer 2 unit transmitted across a LAN. It contains source and destination MAC addresses and carries a Layer 3 packet, such as an IP packet, inside its payload.

From Hubs to Bridges to Switches

Hubs

A hub is a Layer 1 multiport repeater. It does not inspect MAC addresses. When a signal arrives on one port, the hub repeats that signal out the other ports.

Because every connected device shares the same transmission medium, a hub creates one shared collision domain. A collision domain is a segment where simultaneous transmissions can interfere with one another. Hubs also provide no traffic awareness: every attached device receives the repeated signal, whether or not it is the intended recipient.

Bridges

A bridge is a Layer 2 device that examines MAC addresses. It can learn which devices are reachable through which interfaces and forward frames selectively. By separating connected segments, a bridge reduces the size of collision domains.

Switches

A modern Ethernet switch extends the bridge concept with many ports, higher throughput, and specialized hardware. In normal full-duplex operation, each switch port is its own collision domain. A known unicast frame is usually transmitted only through the port leading toward its destination.

Why Layer 2 Switching Is Efficient

Layer 2 switching can make a forwarding decision without examining Network-layer addressing. The switch needs to inspect the Ethernet header and match the destination MAC address against its forwarding information.

Many switches use ASICs (Application-Specific Integrated Circuits). An ASIC is specialized hardware designed for tasks such as matching MAC addresses and selecting output ports. This hardware-assisted processing supports high throughput, low latency, and operation close to wire speed.

Layer 2 switches are also comparatively inexpensive for connecting many devices in one LAN. These advantages do not mean switching replaces routing. When traffic must cross from one IP network or VLAN to another, a router or Layer 3 switch is required.

MAC Addresses and the MAC Address Table

A MAC address is a hardware-oriented Ethernet address used for local frame delivery. A switch stores learned MAC addresses in a MAC address table, also called a CAM table or forwarding database.

Each dynamic entry associates a source MAC address with an incoming switch port and a VLAN context. The VLAN context matters because the same MAC address must be interpreted within the correct logical Layer 2 network.

How Address Learning Works

1. A frame arrives on an ingress port.
2. The switch reads the frame's source MAC address.
3. The switch records the source MAC, ingress port, and VLAN in its table.
4. The switch examines the destination MAC address to decide what to do next.

Dynamic entries are not permanent. If a device remains inactive, its entry eventually ages out and is removed. This prevents stale information from causing frames to be sent toward a port where the device is no longer connected.

If a switch receives a frame from a known source MAC on a different port, it detects MAC movement. The switch updates the entry to the new port. Frequent movement between ports can indicate a device relocation, a topology change, a misconfiguration, or a switching loop.

Frame Forwarding, Filtering, and Flooding

After learning the source address, the switch looks up the destination MAC in the table. The result is one of several forwarding outcomes.

Known Unicast Forwarding

Unicast means traffic addressed to one destination MAC address. If the destination is known and is connected through another port in the same VLAN, the switch forwards the frame only through that port.

For example, suppose Host A is connected to port 1 and Host B to port 5. After learning both addresses, the switch forwards A-to-B traffic from port 1 to port 5 rather than sending it to every port.

Filtering

Filtering means not forwarding a frame because doing so is unnecessary. If the destination MAC is already associated with the ingress port, the switch assumes the destination is reachable through that same port and discards the frame instead of sending it out other ports.

Unknown-Unicast Flooding

An unknown unicast is a unicast frame whose destination MAC address is not currently in the table. The switch cannot choose one destination port, so it floods the frame to all eligible ports in the same VLAN except the port on which the frame arrived.

Broadcast and Multicast

A broadcast is intended for every device in a VLAN. The switch sends it to all eligible ports in that VLAN except the ingress port.

Multicast traffic is addressed to a group rather than one individual destination. At a high level, a switch may send multicast traffic to all ports in the VLAN, or it may use multicast-aware features to forward it only to ports with interested receivers. Multicast handling is distinct from unknown-unicast flooding, even though both may involve multiple egress ports in some configurations.

Flooding does not cross a VLAN boundary. A frame received in VLAN 10 is flooded only within VLAN 10; it is not sent to ports assigned to VLAN 20.

Initial MAC-Learning Example

1. Host A connects to switch port 1 and sends a frame to Host B on port 5.
2. The switch learns Host A's source MAC address on port 1 in the relevant VLAN.
3. Host B's destination MAC is not yet in the table, so the switch floods the frame to eligible ports in that VLAN, except port 1.
4. Host B receives the frame and replies.
5. When the reply arrives on port 5, the switch learns Host B's MAC address on port 5.
6. Subsequent frames between A and B are forwarded directly between ports 1 and 5.

Collision Domains and Broadcast Domains

A collision domain is a network segment in which simultaneous transmissions can collide. A hub places all attached devices in one shared collision domain. A switch normally gives each port its own collision domain, especially when links operate in full-duplex mode.

A broadcast domain is the group of devices that receives a Layer 2 broadcast. A conventional Layer 2 switch does not automatically create a separate broadcast domain for every port. By default, ports in the same VLAN belong to the same broadcast domain.

A VLAN is a logical Layer 2 network. VLANs divide switching infrastructure into separate broadcast domains. Broadcasts and unknown-unicast floods remain inside their originating VLAN.

Communication between VLANs requires Layer 3 forwarding. A router or Layer 3 switch examines IP addressing and routes traffic between the VLANs.

VLAN Forwarding Boundary Example

1. Hosts in VLAN 10 can receive broadcasts and flooded unknown-unicast traffic from other VLAN 10 ports.
2. Hosts in VLAN 20 do not receive those VLAN 10 frames.
3. Hosts in VLAN 10 and VLAN 20 cannot communicate through pure Layer 2 switching.
4. Inter-VLAN communication requires a router or Layer 3 switch.

Layer 2 Loops and Redundant Links

Redundant links improve resilience, but parallel Layer 2 paths can create a forwarding loop. Ethernet frames do not contain a general hop-count mechanism that automatically stops a frame from circulating indefinitely at Layer 2.

A switching loop can cause:

• Broadcast storms: broadcasts circulate and multiply across the loop.
• Duplicate frames: the same frame may arrive through multiple paths.
• Unstable MAC learning: the switch repeatedly sees a source MAC on different ports and changes its table entry.
• Resource exhaustion: links and switch processing capacity can be consumed by looping traffic.

Spanning Tree Protocol

Spanning Tree Protocol (STP) is a Layer 2 loop-prevention protocol. It evaluates redundant paths and creates a loop-free active topology. STP places selected redundant interfaces into a non-forwarding or blocked state while keeping those paths available for recovery.

If an active link fails, STP can transition an alternate path toward forwarding. The result is redundancy without allowing all parallel paths to forward simultaneously.

Conceptually, consider two switches connected by two physical links. STP allows one link to forward and blocks the other. If the forwarding link fails, STP can activate the alternate link.

Inspecting a Cisco IOS Switch

On a Cisco IOS switch, use the following commands to inspect learned MAC addresses:

show mac address-table
show mac address-table dynamic

Look for the MAC address, VLAN, and interface columns. These entries show how the switch has associated a device's source MAC address with a port in a particular VLAN.

To inspect Spanning Tree status, use:

show spanning-tree

Use the output to identify the root bridge, forwarding interfaces, and interfaces in blocking or alternate states.

Switching Versus Routing

When a pure Layer 2 switch forwards a frame between physical interfaces, it processes the Ethernet header and may remove and recreate the physical-interface encapsulation. The Layer 3 packet carried inside is not routed by that switch.

Troubleshooting Layer 2 Switching

A Destination Does Not Appear in the MAC Table

Possible causes include:

• The host has not transmitted traffic recently.
• The dynamic entry aged out.
• The host is disconnected or its interface is down.
• The host is assigned to a different VLAN than expected.

Generate traffic from the host, check interface status and VLAN membership, and inspect the dynamic MAC address table.

Large Amounts of Flooded Traffic

Many unknown destinations, failed learning, frequent host movement, or a Layer 2 topology problem can increase flooding. Review dynamic MAC entries and their associated ports, check for frequent MAC moves, and confirm VLAN and physical connectivity.

Intermittent Connectivity or Broadcast Storms

Intermittent connectivity, duplicate frames, widespread broadcast traffic, and rapidly changing MAC entries can indicate a Layer 2 loop. Inspect STP state on redundant links, locate unintended parallel links or unmanaged switches, and verify that STP is operating as expected.

Hosts on the Same Switch Cannot Communicate

Verify that both ports are up and assigned to the expected VLAN. Check the MAC address table and confirm that traffic is reaching the switch. If the hosts are in different VLANs, determine whether Layer 3 routing is required.

Optional Practice Lab

1. Connect two end hosts to separate ports on one access switch and place them in the same VLAN.
2. Generate traffic between the hosts.
3. Run show mac address-table dynamic and identify each learned MAC address, VLAN, and port.
4. Repeat the test after the entries age out or after changing a host's connection port.
5. Add a second switch with redundant links and use show spanning-tree to identify the forwarding and blocked paths.
6. Optionally configure separate VLANs and observe that broadcasts do not cross the VLAN boundary.

Key Takeaways

• Layer 2 switching forwards Ethernet frames within a LAN using MAC addresses.
• A switch learns source MAC addresses and maps them to ports and VLANs.
• Known unicast frames are forwarded selectively, same-port destinations are filtered, and unknown unicast or broadcast frames are flooded within the VLAN.
• Switch ports normally create separate collision domains, but VLANs—not ordinary switch ports—create separate broadcast domains.
• Routing is required between different IP networks or VLANs.
• STP prevents redundant Layer 2 paths from forming active forwarding loops.