How a switch learns MAC addresses

It starts knowing nothing

Every switch keeps a MAC address table (Cisco also calls it the CAM table): a list that pairs each MAC address with the port where that device lives. When a switch powers on, that table is empty. It has no idea which laptop, printer or phone is plugged into which port.

Nobody types these entries in. The switch fills the table on its own, just by watching traffic.

Learning from the sender

Say laptop A, on port 1, sends a frame to laptop C. Every Ethernet frame carries two addresses: the destination MAC (who it's for) and the source MAC (who sent it).

The switch looks at the source address and writes down: AA:01 is on port 1. That's MAC learning. Every frame that arrives teaches the switch where its sender is.

Unknown? Flood it

Now the switch looks at the destination, C's MAC. It isn't in the table yet, so the switch doesn't know which port leads to C. To be safe it floods the frame: it sends a copy out every port except the one it came in on (in the same VLAN). This is called unknown unicast flooding.

Laptops B and D see that the frame isn't addressed to them and discard it. Only C keeps it.

Known? Straight there

When C replies, its frame carries C's MAC as the source, so the switch learns that C is on port 3. And since it already knows A is on port 1, it sends the reply only out port 1.

From now on, frames between A and C go straight from port 1 to port 3. The other ports stay quiet, which is what makes a switch so much more efficient than an old hub.

Try it yourself

On a Cisco switch (or in Packet Tracer), run show mac address-table. You'll see each learned MAC address with its VLAN, its type (DYNAMIC for learned entries) and its port. Unplug a device, wait a few minutes, and run it again: its entry disappears.

On your own computer, getmac (Windows) or ifconfig / ip link (Mac, Linux) shows the MAC address a switch would learn for you.

Good to know

• The switch learns from source MACs and forwards based on destination MACs.
• Unknown unicast frames are flooded out all ports in the same VLAN except the one they came in on. Broadcasts (destination FF:FF:FF:FF:FF:FF) are flooded too.
• Learned entries age out if a device stays silent; the Cisco default aging time is 300 seconds.
• Devices discard frames that aren't addressed to them.

For CCNA learners

This lines up with CCNA 200-301 exam topic 1.13, describe switching concepts: MAC learning and aging, frame switching, frame flooding and the MAC address table. Be ready to say what a switch does with a frame whose destination is known, unknown or broadcast.

Answer to the comment question

Seven. A frame for an unknown MAC is flooded out every port except the one it came in on, so on an eight-port switch it goes out of the other seven ports (assuming all eight ports are in the same VLAN). It never goes back out port 1, where the sender is.