How a Switch Learns MAC Addresses

What the MAC address table is

Every switch keeps a list called the MAC address table (also called the CAM table, after the Content Addressable Memory it is stored in). Each row says: “this MAC address is reached through this port”.

Nobody types these rows in. The switch fills the table by itself, simply by reading the frames that pass through it. The VLAN column matters on larger networks, where one switch is split into several separate LANs. On a home switch, everything is in one VLAN.

💡 In simple terms: a switch is like a receptionist who notes which desk each person is sitting at by watching where their outgoing letters come from. After a while, incoming letters go straight to the right desk instead of being shouted across the room.

Why switches learn

A hub repeated every frame to every port. Every device received everything, only one device could send at a time, and anyone could see everyone else's traffic. A switch fixes this by sending each frame only out of the port that leads to the destination. To do that, it must know where every device is. Learning is how it finds out, without any configuration.

Where this happens

MAC learning is a Layer 2 job. It happens inside every Ethernet switch, from a five-port desk switch to the switch built into your home router to large office switches. To forward a frame, the switch reads only the Ethernet header: the destination and source MAC addresses. It does not need to look at IP addresses.

The four actions

For every frame that arrives, a switch learns from the source address, then does one of three things with the frame:

Watch a switch learn

Step by step: from an empty table

A switch has just been powered on. PC A (…:aa) is on port 1, PC B (…:bb) is on port 2 and PC C (…:cc) is on port 3. The MAC address table is empty.

What is in the frame (and what is not changed)

The switch makes its decision from the two MAC address fields, and it does not rewrite the frame. The frame that leaves has the same destination MAC address, source MAC address, EtherType and payload as the frame that arrived. (On trunk links, a switch can add or remove a VLAN tag, which the VLAN lesson explains.)

Flooding: unknown unicast and broadcasts

The switch floods a frame in two very different situations:

• Unknown unicast: the frame is for one device, but the switch has not yet learned where that device is. Flooding is a temporary measure: “send it everywhere, and the right device will accept it”. The reply teaches the switch where the device is, and flooding for that address stops.
• Broadcast (ff:ff:ff:ff:ff:ff): the frame really is for everyone, such as an ARP request or a DHCP Discover. The switch always floods these, no matter what is in its table.

Either way, a flooded frame goes out of every port in the same VLAN except the one it came in on. Routers do not forward it, so it stops at the router.

Learn more: Unicast, Broadcast and Multicast · Broadcast Domains

Filtering

Situation: PC A and PC B are both connected to a small desk switch, which connects to one port on the main switch. When A sends to B, the main switch may also receive a copy of the frame, for example while the desk switch is still learning and floods it.

Notice that one switch port can have many MAC addresses behind it. The main switch learns both …:aa and …:bb on Gi1/0/5. That is normal for a port leading to another switch, an access point or a router.

MAC address aging

Entries aren't permanent. If a MAC address isn't seen as a source for 300 seconds (the Cisco default), its entry is removed. This keeps the table up to date when devices move or are switched off, and it frees space. Depending on the platform, a table holds from a few thousand to hundreds of thousands of entries.

If a device moves before its entry ages out, the switch updates the entry as soon as it sees that MAC address as a source on a new port. In each VLAN, a MAC address can be on only one port at a time.

A real-world example: moving desks

Sam unplugs a laptop from port 4 on the second floor and plugs it into port 17 an hour later. The old entry has already aged out, so any frame sent to the laptop before it sends anything is flooded. The laptop's own first frame (often an ARP or DHCP message as it reconnects) teaches the switch the new port, and traffic flows normally again within a second. Nobody had to change anything on the switch.

When MAC learning goes wrong

Seen on a real switch

You do not need to configure anything for learning to work. If you have access to a managed switch, you can view the MAC address table. This is Cisco IOS output:

SW1#show mac address-table dynamic
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    0200.0000.0010    DYNAMIC     Gi1/0/1
  10    0200.0000.0020    DYNAMIC     Gi1/0/2
  20    0200.0000.0030    DYNAMIC     Gi1/0/3
Total Mac Addresses for this criterion: 3

Matching it up from a PC

To find which switch port a PC is on, first get its MAC address from the PC (ipconfig /all on Windows, ip link on Linux). Then look for that MAC address in the switch's table. If you can't reach the PC itself, ping it from another PC on the same LAN and run arp -a to see its MAC address. The ping also makes the device send replies, so the switch learns its port.

Common mistakes

• Thinking the switch learns destination addresses. It learns only source addresses, because only the source tells it which port a device is behind.
• Confusing the MAC address table with the ARP table. A switch's MAC address table maps MAC address → port. A PC's ARP table maps IP address → MAC address.
• Thinking flooding means something is broken. Brief flooding of unknown unicast frames is normal, and broadcasts are always flooded.
• Expecting a switch to stop broadcasts. A switch floods them to every port in the VLAN. Broadcasts stop only at a router (the edge of the broadcast domain).
• Assuming there is only one MAC address per port. A port connected to another switch or an access point can have many MAC addresses behind it.

Check yourself

Where to go next

Next, learn about the cables that connect switches, or see how a PC finds the destination MAC address to put in each frame.

Learn more: Ethernet Physical Layer Standards · Copper Cabling · ARP Fundamentals