Switch MAC Learning and Forwarding

Watch first

Plain-English explanation

A Layer 2 switch forwards frames based on destination MAC addresses, not IP. When a frame arrives, the switch:

1. Learns the source MAC → incoming port mapping
2. Looks up the destination MAC in the CAM table
3. Forwards unicast to one port, floods if unknown, or floods broadcast/multicast by default

This is why switches scale LANs better than hubs — traffic goes only where needed once MACs are learned.

Deep dive

CAM table (MAC address table): Dynamic entries age out (default 300 seconds on many Cisco switches). Static entries survive reboots and prevent learning on that MAC elsewhere.

Forwarding decisions:

| Destination | Action | |-------------|--------| | Known unicast | Forward out single port | | Unknown unicast | Flood (except source port) | | Broadcast / FF:FF:FF:FF:FF:FF | Flood all ports in VLAN | | Same port as source | Discard (no hairpin on same port) |

Microsegmentation: Each switch port in full duplex is its own collision domain. All ports in one VLAN share one broadcast domain.

Step-by-step — trace one frame

Topology: PC-A (MAC aa:aa) on Fa0/1, PC-B (MAC bb:bb) on Fa0/2, CAM empty.

1. A sends to B — switch learns aa:aa on Fa0/1
2. bb:bb unknown → flood Fa0/2, Fa0/3, … (not Fa0/1)
3. B replies — switch learns bb:bb on Fa0/2
4. Next A→B frame unicast only to Fa0/2

Commands to know

show mac address-table
show mac address-table dynamic
show mac address-table address aaaa.bbbb.cccc
mac address-table static aaaa.bbbb.cccc vlan 10 interface Gi0/1

clear mac address-table dynamic
debug swmacs mac-move

Troubleshooting

| Symptom | Likely cause | |---------|--------------| | Unicast flooded constantly | Destination never responds — down host, wrong VLAN | | MAC flapping messages | Loop, duplicate MAC, mis-cabled redundant paths | | Host reachable intermittently | Two ports learning same MAC — loop or NIC teaming issue | | Table full | CAM overflow attack or huge broadcast domain — segment VLANs |

Use show mac address-table with show vlan brief together — MAC learning is per VLAN.

Exam relevance

Practice checklist

• Predict CAM contents after three frames in a small topology
• Explain difference between flood and broadcast
• Configure a static MAC and verify with show commands
• Describe what happens when CAM is cleared mid-traffic
• Relate MAC learning to ARP from Week 1