Every Ethernet switch makes the same basic decision millions of times a second: given a frame that just arrived, where should it go? The answer comes down to two pieces of information — the port the frame arrived on and the frame’s destination MAC address — and a dynamically-built table that maps addresses to ports. Understanding exactly how that table gets built and used is foundational CCNA and CCNP material.
This guide covers frame forwarding fundamentals, a complete worked example of MAC address table learning, the three switching methods you’ll be tested on, and a security angle worth knowing: how this same mechanism can be attacked.
Switching Basics
Switching decisions hinge on two pieces of information:
- Ingress port: the port a frame arrives on.
- Destination MAC address: the address the frame is addressed to, which the switch looks up against its MAC address table (also called the CAM table — Content Addressable Memory table) to determine the correct egress port.
Cisco switches, including the Catalyst 9200 series, store this table in high-speed CAM memory specifically because lookups need to happen at line rate, keeping pace with traffic arriving on every port simultaneously.
Example MAC Address Table
| Ingress Port | Destination MAC Address | Egress Port |
|---|---|---|
| 1 | DB-CD-AC-3D-26-25 | 7 |
| 6 | C3-A3-A2-35-A6-66 | 8 |
| 2 | EE-01-A1-AF-00-01 | 1 |
A switch’s entire forwarding intelligence comes down to maintaining this one table and making decisions based on it — nothing more exotic than that. The table is dynamic, populated automatically as traffic flows through the switch, and each switch maintains just one such table covering all of its ports.
How the MAC Address Table Gets Built
The table starts empty and populates itself through normal traffic — a process worth walking through step by step, since it comes up constantly in CCNA exam scenarios and real troubleshooting alike.
Step 1 — Learning the source. When a frame arrives, the switch checks its source MAC address against the table. If that address isn’t already there, it adds a new entry, mapping the source MAC to the ingress port it just arrived on. If it’s already there, the switch resets that entry’s aging timer instead of adding a duplicate.
Step 2 — The aging timer. Each table entry has an aging timer, 5 minutes (300 seconds) by default on Cisco switches. If no traffic arrives from a given MAC address before its timer expires, the entry is removed — this keeps the table from accumulating stale entries for devices that have disconnected or moved to a different port.
Step 3 — Handling the destination. The switch then checks the frame’s destination MAC address against the table. If the destination is unknown (not yet in the table) or is the broadcast address (FF-FF-FF-FF-FF-FF), the switch floods the frame out every port except the one it arrived on — this is the only situation in which flooding happens on a switch, as opposed to a hub which floods every single frame regardless.
Step 4 — Learning the response. When the destination device replies, its response frame lets the switch learn that device’s MAC address too, associating it with its own port. From this point forward, both devices are in the table, and frames between them travel as direct unicast — no more flooding required for that conversation.
Worked Example
Consider a switch connected to four hosts, with an empty MAC table:
- Host 1 sends a frame on Port 1, destined for Host 4, whose MAC address isn’t yet known. The switch learns Host 1’s MAC address on Port 1, then floods the frame out every other port (2, 3, and 4) since the destination is unknown.
- Host 4 receives the flooded frame and replies. The switch learns Host 4’s MAC address on Port 4 from this response.
- The table now contains two entries: Host 1’s MAC on Port 1, and Host 4’s MAC on Port 4. Ports 2 and 3 remain unassigned, since neither Host 2 nor Host 3 has sent traffic yet.
- Any further communication between Host 1 and Host 4 now travels as direct unicast frames — the switch already knows exactly which port to use for each, with no flooding involved.
This is the exact mechanism that makes switches dramatically more efficient than hubs at scale: flooding only happens for genuinely unknown destinations or broadcast traffic, not for every single frame.
Switching Methods
How a switch decides when to start forwarding a frame — not just where — depends on which switching method it uses. This is a commonly tested CCNA topic that’s easy to overlook:
| Method | How It Works | Latency | Error Checking |
|---|---|---|---|
| Store-and-forward | Reads the entire frame into buffer memory and verifies the Frame Check Sequence (FCS) before forwarding | Highest | Full — drops corrupted frames |
| Cut-through | Begins forwarding as soon as the destination MAC address is read, without waiting for the rest of the frame | Lowest | None — corrupted frames may be forwarded |
| Fragment-free | Reads the first 64 bytes (enough to catch most collision fragments) before forwarding | Moderate | Partial — catches common collision-related errors, not full FCS |
Store-and-forward is the default and most common method on modern Cisco switches, since it guarantees corrupted frames get dropped rather than propagated further into the network — a meaningful benefit that generally outweighs the latency cost on switches fast enough that the difference is imperceptible in practice. Cut-through switching sees use in latency-sensitive, high-throughput environments (some data center and financial trading applications) where every microsecond matters enough to accept the error-checking trade-off. Fragment-free exists largely as a historical middle ground from the era of shared, collision-prone Ethernet segments, and sees far less use on modern switched, full-duplex networks where collisions of the kind it was designed to catch simply don’t occur in the first place.
Verifying the MAC Address Table
View the current table on a Cisco switch:
show mac address-tableFilter to a specific VLAN or port:
show mac address-table vlan 10
show mac address-table interface GigabitEthernet0/1Clear dynamically-learned entries (useful when troubleshooting a device that’s moved to a different port, since a stale entry will otherwise cause traffic to keep heading toward the old port until it ages out):
clear mac address-table dynamicAdjust the aging timer if the default 5 minutes doesn’t fit your environment — shortening it makes the table adapt faster to devices moving between ports, at the cost of slightly more relearning overhead:
Switch(config)# mac address-table aging-time 180Security Implications: MAC Flooding and CAM Table Overflow
The same learning mechanism that makes switching efficient also creates an attack surface worth understanding. A switch’s CAM table has finite capacity — typically thousands of entries, but finite regardless. A MAC flooding attack deliberately sends a huge volume of frames with randomized, fake source MAC addresses, attempting to fill the table entirely.
Once the table is full, many switches fail open rather than closed: unable to learn any new legitimate entries, the switch starts flooding all traffic out every port, effectively behaving like a hub. This lets an attacker on any port passively capture traffic that should never have reached them, since it’s now being broadcast everywhere rather than switched directly to its intended destination.
Port Security is the standard Cisco mitigation, limiting how many MAC addresses can be learned on a given port:
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security violation restrictSetting a low maximum on access ports — 1 or 2 for a typical end-user port — prevents any single port from being used to flood the table, while violation restrict drops offending traffic and logs the event rather than shutting the port down entirely, which is often preferable on a production network where you’d rather investigate than immediately disrupt connectivity.
Verify port security status:
show port-security
show port-security interface GigabitEthernet0/1
Troubleshooting MAC Address Table Issues
A device isn’t reachable despite being connected: check whether its MAC address actually appears in the table, and on the port you expect.
show mac address-table address <mac-address>If it’s missing entirely, confirm the device is actually sending traffic — a completely silent device (like one that’s powered off, or hasn’t sent anything since connecting) won’t appear until it does.
A device seems to move between ports unexpectedly, sometimes called MAC flapping: this usually indicates either a real physical topology issue (like a loop, if Spanning Tree isn’t handling it correctly) or, less commonly, the same device genuinely connected via two different paths simultaneously. Persistent flapping warrants checking your Spanning Tree Protocol configuration before assuming it’s a switch hardware fault.
Port security keeps blocking a legitimate device: check the configured maximum against how many devices actually need to be learned on that port — a port connecting a PC and a daisy-chained IP phone needs a maximum of at least 2, not 1, since both devices’ MAC addresses need to be learned there.
show port-security interface GigabitEthernet0/1FAQs
What is the role of a network switch in managing broadcast traffic?
A switch manages broadcast traffic by directing frames only to the port where the destination actually lives, based on its MAC address table, rather than repeating every frame out every port the way a hub does. Flooding still happens for genuinely unknown destinations and broadcast traffic specifically, but it’s the exception rather than the default behavior.
How does a MAC address table help in network switching?
The MAC address table maps learned source MAC addresses to the ports they were learned on, letting the switch forward frames directly to their destination once both devices in a conversation have been learned. This targeted delivery is what allows a switch to support many simultaneous conversations without them interfering with each other, unlike a shared hub-based network.
What are the different switching methods a Cisco switch can use?
The three methods are store-and-forward (reads and verifies the entire frame before forwarding, catching corrupted frames but adding latency), cut-through (forwards as soon as the destination address is read, minimizing latency but skipping error checking), and fragment-free (a middle ground, checking just the first 64 bytes). Store-and-forward is the default on most modern Cisco switches, since the latency cost is negligible on current hardware while the error-checking benefit is real.
What is MAC flooding, and how does port security prevent it?
MAC flooding is an attack that floods a switch with frames using randomized fake source addresses, attempting to fill its finite CAM table and force it to fail open into hub-like flooding behavior. Port security prevents this by limiting how many MAC addresses a given port is allowed to learn, blocking or restricting traffic once that limit is exceeded rather than letting the table overflow.
Why does a MAC address table entry sometimes disappear?
Every entry has an aging timer, 5 minutes by default on Cisco switches, and an entry is removed if no traffic arrives from that MAC address before the timer expires. This is intentional housekeeping — it keeps the table from filling up with stale entries for devices that have disconnected, been powered off, or moved to a different port.
How can I verify what’s currently in a switch’s MAC address table?
Use show mac address-table to view the full table, or narrow it with show mac address-table vlan <id> or show mac address-table interface <interface> to check a specific segment. This is one of the most frequently used commands in real switch troubleshooting, since it directly confirms whether a device has actually been learned and on which port.
