Hello! In our last few lessons, we've been operating at Layer 3 of the OSI model, configuring and verifying how routers like OSPF make intelligent decisions to forward packets between different networks. Now, we're shifting our focus down to Layer 2 to explore the inner workings of the local area network (LAN) itself.
This lesson unpacks the fundamental logic of a network switch. You already have a good grasp of what MAC addresses are and the basic role of a switch, so we'll dive straight into the "how." We'll explore the process a switch uses to learn where devices are located and how it uses that knowledge to forward frames efficiently. This is a cornerstone of network engineering and essential for your project.
By the end of this lesson, you will be able to explain exactly how a switch builds and uses its MAC address table to forward Ethernet frames.
The Switch's Brain: The MAC Address Table
At the heart of a Layer 2 switch's operation is its MAC address table, sometimes called a Content-Addressable Memory (CAM) table. Think of it as a dynamic directory that maps the MAC addresses of connected devices to the specific physical switch ports they are connected to.
A switch builds and uses this table based on a simple but powerful two-step logic:
- Learn the Source: When a frame enters a switch port, the switch inspects the source MAC address. It records this MAC address and the port it came in on in its MAC address table. This is the learning process.
- Forward or Flood the Destination: Next, the switch inspects the destination MAC address.
- If that destination MAC exists in its table, the switch forwards the frame only to the corresponding port. This is efficient and private.
- If the destination MAC is not in the table (an "unknown unicast"), the switch has no choice but to flood the frame, sending a copy out of all ports except for the one it arrived on.
The following video provides an excellent visual walkthrough of this entire process.
How switches learn MAC addresses - CCNA 200-301
The video "How switches learn MAC addresses" from the Network Engineer Pro channel clearly demonstrates the core switching logic.
Please watch the first three sections of the video: Introduction: This part introduces the MAC address table and sets up the scenario. Learning and Flooding: Pay close attention to how the switch populates its table based on the source MAC address and what it does when the destination is unknown. Forwarding: This section shows how the switch behaves once it has learned the locations of the devices.
As the video explains, the switch dynamically builds this table as devices communicate. The image below, taken from a Packet Tracer simulation, shows this in action. The table on the left is empty on a freshly started switch, while the table on the right is populated after devices have started sending frames.
Reinforcing the Logic: Four Key Scenarios
To solidify your understanding, let's consider the four possible scenarios a switch might encounter when a frame from PC1 to PC3 arrives. The next section of the video you just watched walks through these as a quiz. Try to answer each question yourself before watching the explanation.
How switches learn MAC addresses - CCNA 200-301
This part of the video from Network Engineer Pro tests your understanding with four distinct scenarios.
Watch the section from the quiz. For each of the four questions posed, pause the video and predict the switch's behavior based on what's known or unknown in the MAC address table. Source & Destination Unknown: What does the switch do? Source Unknown, Destination Known: What does the switch do? Source Known, Destination Unknown: What does the switch do? Source & Destination Known: What does the switch do?
This "learn on source, forward/flood on destination" logic is fundamental. The process is often summarized as "Flood and Learn." Initially, a switch floods a lot, but as it learns where devices are, it becomes much more efficient, forwarding frames directly.
Practical Application: Verifying the MAC Address Table
For your project and any real-world network administration, you'll need to know how to view and manage the MAC address table from the command-line interface (CLI). This is crucial for troubleshooting connectivity issues, like figuring out which port a specific device is plugged into.
The primary command is show mac address-table. Let's see it in action.
How switches learn MAC addresses - CCNA 200-301
The final part of the video provides a hands-on demonstration of the CLI commands used to manage the MAC address table on a Cisco switch. This is directly relevant to your practical work.
Watch the entire hands-on demonstration from the hands-on portion. Pay attention to these key commands and concepts: show mac address-table: The main command to view all entries. show mac address-table count: To see a summary of learned addresses. show mac address-table address [mac]: To find a specific device. clear mac address-table dynamic: To erase all dynamically learned entries. Aging Time: The video explains that entries are removed after a default of 300 seconds (5 minutes) if not refreshed. You'll see how to view (show mac address-table aging-time) and change this setting. Static Entries: You'll also see how to manually create a permanent entry that never ages out.
Summary of Key Concepts
Let's consolidate the core ideas of this lesson. Understanding these terms is essential for describing switch behavior.
Overview of Switching Logic - Ethernet Networks
This section from NetworkAcademy.IO provides a concise summary of the most important terms and processes related to switching.
Read the section titled "Key takeaways". Focus on the clear definitions provided for: Flood and Learn: The two-part process that defines switch operation. BUM traffic: The types of traffic (Broadcast, Unknown Unicast, Multicast) that a switch will always flood. MAC Aging timer: The mechanism that keeps the MAC address table current by removing stale entries.
Conclusion
In this lesson, we've dissected the core logic of a Layer 2 switch. You've learned how it populates its MAC address table by inspecting the source address of incoming frames and how it uses that table to make intelligent forwarding decisions. When a destination is unknown, the switch resorts to flooding, but this is part of the "Flood and Learn" mechanism that ultimately leads to efficient network communication.
Key Takeaways:
- Switches build a MAC address table to map MACs to ports.
- Learning: A switch populates its table by examining the source MAC address of every frame it receives.
- Forwarding: If the destination MAC is in the table, the frame is sent only to the corresponding port.
- Flooding: If the destination is unknown (or is a broadcast/multicast), the frame is sent to all ports except the one it arrived on.
- The
show mac address-tablecommand is your primary tool for verifying and troubleshooting this process on a Cisco device.
This understanding of frame forwarding is critical. However, the flooding behavior, while necessary, can introduce a major problem. If you connect switches in a loop (for example, with two cables for redundancy), this flooding mechanism can create a "broadcast storm" that completely paralyzes the network. In our next lesson, we will explore the Spanning Tree Protocol (STP), the clever mechanism switches use to prevent these catastrophic loops while still allowing for redundant physical connections.