VMware ESXi and vSphere Cluster Management
What Is a Network Switch?
Learn what a network switch does, how it uses MAC addresses to forward Ethernet frames, and how switches compare with network bridges.
A network switch is a device that connects multiple endpoints within a local area network (LAN). A LAN connects devices over a limited geographic area, such as a home, office, classroom, or building. PCs, servers, printers, wireless access points, and other network devices can connect to switch ports and exchange Ethernet traffic.
A switch forwards Ethernet frames between its ports. Instead of sending every ordinary unicast frame to every connected device, it learns where devices are located and sends known traffic only toward the intended destination. This makes LAN communication more efficient and reduces unnecessary traffic.
Technically, a switch is a high-speed, multiport implementation of network bridge technology. A bridge and a switch use the same fundamental Layer 2 logic: learn MAC addresses, then filter or forward Ethernet frames based on those addresses.
Where a Switch Fits in Networking
A typical Ethernet switch operates at OSI Layer 2, the Data Link layer. Layer 2 is responsible for local delivery using Ethernet frames and MAC addresses.
A MAC address is a Layer 2 hardware address used to identify an Ethernet interface on a LAN. A switch uses the source and destination MAC addresses in each Ethernet frame to make forwarding decisions. It normally does not need to examine the destination IP address to perform basic Layer 2 forwarding.
An Ethernet frame is the Layer 2 data unit carried across an Ethernet link. It includes fields such as a destination MAC address, a source MAC address, and a payload. The payload may contain a Layer 3 packet, such as an IP packet.
| Data unit | Layer | Address commonly used for local forwarding | Example role |
|---|---|---|---|
| Ethernet frame | Layer 2, Data Link | MAC address | A switch forwards the frame inside a LAN. |
| IP packet | Layer 3, Network | IP address | A router selects a path between different IP networks. |
The MAC Address Table
Every switch maintains a MAC address table. This table is also called a forwarding table or a CAM table. CAM refers to the memory technology traditionally used for fast address lookups.
The table associates a learned source MAC address with the switch port through which that address is reachable. Entries are dynamic: the switch learns and updates them as frames arrive, and entries can be removed after they have not been used for a period of time.
When a frame arrives, the switch records the frame's source MAC address and the incoming, or ingress, port. This tells the switch where that source device can be reached. The switch then looks up the destination MAC address to decide whether it can select one outbound port.
Example of Source-MAC Learning
- A host sends its first Ethernet frame through switch port 1.
- The switch reads the frame's source MAC address.
- The switch records or updates a mapping between that MAC address and port 1.
- Future frames addressed to that MAC address can be sent to port 1.
For example, if Host C sends a frame through port 3, the switch can learn that Host C's MAC address is reachable through port 3. The table might then look like this:
| MAC address | Associated switch port | How the entry was learned | Forwarding result for frames to that MAC |
|---|---|---|---|
| 00:00:00:00:00:0A | Port 1 | Source address of a frame received from Host A | Send the frame through port 1 |
| 00:00:00:00:00:0B | Port 2 | Source address of a frame received from Host B | Send the frame through port 2 |
| 00:00:00:00:00:0C | Port 3 | Source address of a frame received from Host C | Send the frame through port 3 |
How a Switch Forwards Frames
The basic Layer 2 forwarding sequence is:
- The switch receives an Ethernet frame on an ingress port.
- It reads the frame's source MAC address and learns or refreshes its association with the ingress port.
- It inspects the destination MAC address.
- It consults the MAC address table.
- If the destination is known, it sends the frame through the associated outbound port. Otherwise, it applies the appropriate flooding or replication behavior.
Known Unicast Forwarding
A known unicast is a frame whose destination MAC address has an entry in the MAC address table. The switch forwards the frame only through the port associated with that destination MAC address.
Suppose Host A, Host B, and Host C connect to separate ports on one switch. If the switch has learned Host C's MAC address on port 3, the process is:
- Host A sends an Ethernet frame addressed to Host C's destination MAC address.
- The switch receives the frame from Host A's port.
- The switch checks the destination MAC address.
- The MAC address table identifies Host C on port 3.
- The switch forwards the frame only through Host C's port.
Host B does not receive that known unicast frame. The switch does not need to copy it to unrelated ports.
Unknown Unicast Flooding
An unknown unicast is a unicast frame whose destination MAC address is not currently in the table. Because the switch cannot select one known destination port, it floods the frame out applicable ports except the port on which the frame arrived.
When the destination device responds, the switch can learn the source MAC address from that response. Later frames can then use known unicast forwarding instead of flooding. Flooding is therefore a normal behavior during address learning, after an entry expires, or when a destination has moved to another port.
Broadcast and Multicast Traffic
A broadcast is traffic intended for every device in the same broadcast domain. At an introductory level, a switch forwards a broadcast frame out the relevant ports except the incoming port, so multiple devices can receive it.
Multicast traffic is addressed to a group of receivers rather than one device or every device. A switch may replicate multicast frames to relevant ports. The exact behavior depends on the switch and its configuration; without mechanisms that identify interested receivers, multicast may be treated similarly to flooding within the local segment.
| Destination type or lookup result | Switch action | Ports receiving the frame |
|---|---|---|
| Known unicast | Look up the destination MAC and forward selectively | Only the port associated with that MAC, unless filtering rules apply |
| Unknown unicast | Flood because the destination location is not known | Applicable ports except the incoming port |
| Broadcast | Replicate within the broadcast domain | Relevant ports except the incoming port |
| Multicast | Replicate to the multicast group or flood when receiver information is unavailable | Ports selected for the group, or applicable ports depending on operation |
Collision Domains and Full-Duplex Ethernet
A collision domain is a network area in which simultaneous Ethernet transmissions could collide during half-duplex operation. Shared Ethernet media places multiple devices in one collision domain: they contend for access to the same medium.
In switched Ethernet, each individual switch port is normally a separate collision domain. A host connected to one port does not share its transmission medium with hosts connected to other switch ports.
Full duplex is a communication mode in which both sides of an Ethernet link can transmit and receive at the same time. A host and a switch can therefore send data simultaneously over a properly operating full-duplex link.
Because full-duplex switched links do not use a shared medium, collisions are not expected. A link that reports collisions or performs poorly while configured for full duplex may have a duplex mismatch, a physical-layer problem, or another link-related configuration issue.
| Technology | Primary role | Typical number of connections | Forwarding basis | Collision-domain behavior | Duplex characteristics |
|---|---|---|---|---|---|
| Shared Ethernet media | Several devices share one medium | Multiple devices on one shared segment | Shared-media access rules | One shared collision domain | May require half duplex |
| Traditional bridge | Connect Ethernet segments and filter or forward frames | Relatively few ports | Learned MAC addresses | Separates connected segments into collision domains | Can support full duplex on point-to-point links |
| Ethernet switch | Connect many LAN endpoints and forward frames efficiently | Many ports | Learned MAC addresses and forwarding rules | Each switch port is normally a separate collision domain | Normally full duplex on host links |
What Is a Network Bridge?
A network bridge is a Layer 2 device that connects Ethernet network segments. It forwards frames based on MAC addresses rather than IP addresses.
A bridge learns source MAC addresses in much the same way as a switch. It associates each learned address with the segment or port where that address is reachable. When a frame arrives, the bridge can filter it if the destination is already on the same segment, forward it toward a known destination segment, or flood it when the destination is unknown.
Switch Versus Bridge
A switch and a traditional bridge are not unrelated technologies. A switch performs the fundamental Layer 2 bridging function, but it is generally designed as a high-speed, multiport device for connecting many endpoints.
Traditional bridges commonly had relatively few ports and were used to join network segments. Switches provide many ports, specialized hardware for fast forwarding, and often management or additional switching capabilities. In practical networking, the term switch is standard for the multiport devices used to connect hosts in a LAN, while bridge describes the underlying forwarding function and older or smaller implementations.
The shared idea is simple: both devices learn MAC addresses and use those mappings to filter or forward Ethernet frames.
Practical Scenarios
Three Hosts and a Known Destination
Host A, Host B, and Host C each connect to separate switch ports. The switch has already learned Host C's MAC address on Host C's port. When Host A sends a frame to Host C, the switch performs a destination lookup and forwards the known unicast only to Host C's port. Host B does not receive that ordinary unicast frame.
A Newly Learned Source Address
When a host sends its first frame, the switch does not need to know the host in advance. It reads the source MAC address and records the source-to-ingress-port association. This dynamic learning allows the switch to build its forwarding table from observed traffic.
An Unknown Destination
If a switch receives a unicast frame for a MAC address that is absent from its table, it cannot choose one destination port. It floods the frame through relevant ports other than the receiving port. A response from the destination supplies a source MAC address that the switch can learn, allowing subsequent traffic to become known unicast.
Full-Duplex Host-to-Switch Communication
On a full-duplex link, a host can transmit data to the switch while the switch transmits data to the host. The link does not depend on shared-media collision detection, so properly functioning full-duplex switched Ethernet does not normally experience collisions.
Troubleshooting Concepts
Traffic Initially Appears on Several Ports
If a device's frame is initially seen on multiple switch ports rather than only at its intended destination, the destination MAC address may not yet be present in the MAC address table. The switch treats the frame as unknown unicast and floods it. After return traffic allows the switch to learn the destination location, later frames can be forwarded as known unicast.
Collisions on a Full-Duplex Link
Collisions on a properly operating full-duplex switched link are not expected. A duplex mismatch, a physical cabling or interface problem, or another link-layer configuration issue may be responsible. First distinguish full duplex from half duplex: half duplex uses shared access rules and can experience collisions, while full duplex permits simultaneous transmission in both directions.
Traffic Reaches an Unexpected Set of Devices
Determine whether the traffic is known unicast, unknown unicast, broadcast, or multicast. Known unicast traffic normally goes to one learned destination port. Broadcast traffic is intended for every device in the broadcast domain. Unknown unicast is flooded while the destination location is unknown, and multicast may be replicated to a group or flooded when the switch lacks receiver information.
Key Points to Remember
- A network switch connects multiple devices within a LAN.
- A typical Ethernet switch operates at OSI Layer 2 and forwards frames using MAC addresses.
- An Ethernet frame is a Layer 2 data unit; an IP packet is a Layer 3 data unit carried inside a frame.
- The MAC address table, forwarding table, or CAM table maps learned MAC addresses to switch ports.
- Known unicast frames are forwarded only through the port associated with the destination MAC address.
- Unknown unicast frames are flooded out applicable ports except the incoming port until the destination can be learned.
- Broadcast and multicast traffic can be delivered to multiple ports, unlike ordinary known unicast traffic.
- Each switch port is normally a separate collision domain, and full-duplex links permit simultaneous sending and receiving.
- A switch is best understood as a high-speed, multiport network bridge rather than as a completely different technology.
For a concise reference, see What Is a Network Switch?.