How Does a Switch Learn MAC Addresses?

When you connect devices to a network switch, something magical happens behind the scenes. The switch automatically learns which devices are connected to which ports, and it uses this information to forward frames efficiently. Let's dive into how this process works.

What is a MAC Address Table?

Every switch maintains a MAC address table (also called a CAM table or forwarding table). This table maps MAC addresses to switch ports. When a switch receives a frame, it looks up the destination MAC address in this table to decide where to send the frame.

Note

The MAC address table is stored in Content Addressable Memory (CAM), which allows for very fast lookups. This is why it's sometimes called a CAM table.

The Learning Process

When a switch receives a frame on a port, it performs the following steps:

Examine the source MAC address of the incoming frame
Check if the MAC address already exists in the MAC table
If not present, add the MAC address and the port number to the table
If present but on a different port, update the entry (device moved)
Set or refresh the aging timer for the entry

A Simple Example

Let's visualize this with a simple network topology:

    +------+           +--------+           +------+
    |  H1  |---F0/1----|        |----F0/2---|  H2  |
    | MAC: |           | Switch |           | MAC: |
    | AAAA |           |        |           | BBBB |
    +------+           +--------+           +------+

When H1 sends a frame to H2, the switch receives the frame on port F0/1. The switch reads the source MAC address (AAAA) and adds it to the MAC table associated with port F0/1.

Viewing the MAC Address Table

On Cisco switches, you can view the MAC address table using the following command:

cisco

Switch# show mac address-table
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    aaaa.aaaa.aaaa    DYNAMIC     Fa0/1
   1    bbbb.bbbb.bbbb    DYNAMIC     Fa0/2

Frame Forwarding Decisions

Once the switch has learned MAC addresses, it uses this information to make forwarding decisions:

Known Unicast: If the destination MAC is in the table, forward only to that port
Unknown Unicast: If the destination MAC is not in the table, flood to all ports (except the source port)
Broadcast: Forward to all ports (except the source port)
Multicast: Forward to registered multicast group ports or flood

Tip

Unknown unicast flooding is necessary when a switch doesn't yet know where a device is located. Once that device responds, the switch learns its location.

MAC Address Aging

MAC address entries don't stay in the table forever. Each entry has an aging timer (default is usually 300 seconds or 5 minutes). If no frame is received from that MAC address before the timer expires, the entry is removed from the table.

cisco

Switch# show mac address-table aging-time
Global Aging Time:  300
Vlan    Aging Time
----    ----------
   1       300

Note

Aging helps prevent stale entries from taking up table space when devices are disconnected or moved to different networks.

Summary

Switch MAC address learning is an automatic, efficient process that happens transparently. By examining source MAC addresses of incoming frames, switches build a forwarding table that enables intelligent frame delivery instead of flooding everything to everywhere.