Ethernet switching
MAC address learning and aging, frame switching and flooding decisions, and how to read the MAC address table.
MAC learning and aging
MAC learning and forwarding
- A frame arrives: the switch records the source MAC → ingress port in the MAC address table.
- It looks up the destination MAC: known unicast → forward out the listed port only.
- Unknown unicast, broadcast, or multicast without snooping → flood out all ports except the source port.
- Entries age out (default ~300 seconds of silence) and are relearned on the next frame.
Aging keeps the table honest: if a host moves ports, the stale entry expires or is overwritten the moment the host sends a new frame. A full table forces flooding for all new destinations — a security and performance problem exploited by MAC flooding attacks, which is why port security limits learned MACs.
Frame switching and flooding
Frame forwarding decisions
| Destination MAC | Switch action |
|---|---|
| Known unicast in table | Forward out the single mapped port |
| Unknown unicast | Flood out all ports except ingress |
| Broadcast (ff:ff:ff:ff:ff:ff) | Flood out all ports except ingress |
| Multicast | Floods unless IGMP snooping maps it |
- Setup
- PC-A on Gi0/1 pings PC-B on Gi0/2; MAC table is empty
- PC-A's ARP request is a broadcast → flooded to all ports except Gi0/1.
- PC-B's ARP reply is unicast to PC-A's MAC; the switch learns PC-B's MAC on Gi0/2 and forwards only to Gi0/1.
- The echo request now finds PC-B's MAC known → switched point-to-point.
One broadcast flood, then everything is table-driven forwarding.
Verification
Vlan Mac Address Type PortsEntries are per-VLAN. 10 001a.2b3c.4d5e DYNAMIC Gi0/5Host learned on Gi0/5 in VLAN 10. 10 00aa.bb01.0201 DYNAMIC Gi0/24Uplink toward the rest of the network.Verify learned addresses and aging — Privileged EXEC
Cisco IOS / IOS XE
show mac address-table show mac address-table dynamic show mac address-table interface gi0/5 show mac address-table count
- Expected host MACs appear on the correct ports and VLANs.
- DYNAMIC entries mean learned; STATIC means manually configured or secure.
Read-only verification commands.
Common mistakes
- Thinking the switch broadcasts ARP replies — replies are unicast once the table knows the MAC.
- Forgetting aging — a moved host can be blackholed until the stale entry expires or a frame relearns it.
- Looking up MACs without the VLAN context — the same MAC can legitimately exist on different ports in different VLANs.
- Confusing flooding (normal for unknown/broadcast) with a loop — a loop is continuous duplication, not a single flood.
Observation: A PC moved to a new jack cannot be reached, but it can reach others.
- New port in a different VLAN
- Stale MAC entry pointing at the old port
- Port security disabled the port
| Check | Indicates |
|---|---|
show mac address-table address <mac> | Port/VLAN listed vs actual jack pinpoints a wrong-VLAN assignment. |
show interfaces status on the new port | err-disabled means a security feature acted, not a table problem. |
| Have the host send traffic / clear the old entry | Relearning on the new port restores forwarding. |
Correction: Move the port to the right VLAN or clear the stale entry/disable cause.
MAC relearns on the new port and traffic flows both ways.
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- Cisco — LAN Switching Command Reference — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.