Learn how a Layer 2 switch learns MAC addresses, chooses forwarding paths, handles unknown destinations, and manages table entries over time.

What you will be able to do

Explain how a switch uses a MAC address table to connect MAC addresses with ports and VLANs.
Describe how a switch learns or updates a source MAC address after receiving a frame.
Trace how a switch forwards a frame when the destination MAC address is known or unknown.
Explain how aging, learned-MAC limits, and MAC flooding affect forwarding behavior.

The Switch’s Learning Job

A Layer 2 switch manages a MAC address table to make Ethernet forwarding decisions. This process is called MAC Address Table Management, or MATM.

The table connects a MAC address with a switch port and a VLAN. That relationship helps the switch send frames toward the correct local connection instead of treating every frame identically.

Two Questions for Every Frame

When a frame arrives, the switch handles two separate questions. First, it learns where the sender is; second, it decides where the receiver should be reached.

The sender’s location comes from the source MAC address. The forwarding decision comes from the destination MAC address, so learning and forwarding use different fields for different purposes.

Learning a New Source

Suppose a frame enters on port 3 in VLAN 20, and its source MAC address is not yet listed. The switch records that MAC address with port 3 and VLAN 20.

This gives the switch a usable location for later frames sent to that device. The entry is learned from the frame’s arrival rather than from a separate address directory.

Correcting a Moved Device

A learned device may later appear through another port. If the same source MAC address arrives on port 7 in VLAN 20, the switch replaces the older port association with the new incoming port and VLAN.

This update keeps the table aligned with the device’s current observed location. The switch therefore treats new source information as a reason to revise an existing entry.

Forwarding to a Known Destination

After processing the source, the switch examines the destination MAC address. It searches the MAC address table for a matching entry.

If the table identifies the destination, the entry supplies the associated port and VLAN. The switch can then use that learned relationship to direct the frame toward the destination.

When the Destination Is Unknown

If the destination MAC address has no table entry, the switch floods the frame within the same VLAN. Flooding sends it through the VLAN’s other ports, but not back through the port where the frame arrived.

Known and unknown destinations therefore produce different behavior. A known destination supports targeted forwarding, while an unknown one causes same-VLAN distribution.

Keeping the Table Current

A table entry does not remain forever without activity. When no frame from a source MAC address arrives through its associated port during the aging time, the switch removes that entry.

An aging time that is too short can make the switch relearn addresses repeatedly. That repeated learning increases switch overhead, so table timing affects how efficiently learning operates.

Entry Types and Table Pressure

Dynamic MAC addresses are the most common table entries. Sticky MAC addresses combine features of dynamic and static learning, providing another way to represent learned addresses.

Sticky learning can be enabled on an interface with `switchport port-security mac-address sticky`. Separately, exceeding the learned-MAC limit may cause unknown unicast frames to flood through all ports in the VLAN.

Recap: Ready for Practice and Prove

A switch’s MAC address table maps MAC addresses to ports and VLANs. MATM is the ongoing work of building, maintaining, and using that table.

The switch learns from the source MAC address. It adds an unseen source or updates the entry when that source appears through a different port and VLAN.

The switch forwards by examining and looking up the destination MAC address. A known destination supports directed forwarding, while an unknown destination is flooded within the same VLAN except through the receiving port.

Aging removes entries that stop appearing on their associated ports. An overly short aging time can trigger frequent relearning and extra overhead.

Dynamic entries are common, sticky learning combines dynamic and static characteristics, and a learned-MAC limit can increase flooding. MAC flooding deliberately sends many unique source addresses to fill the CAM table and force flooding behavior.

In Practice and Prove, trace source learning separately from destination forwarding. Then identify how aging, table limits, and MAC flooding change the switch’s behavior.

Switch Learning and Forwarding