How Ethernet Switches Work: MAC Address Learning and Frame Forwarding

Ethernet switches are the backbone of modern local area networks (LANs), enabling efficient communication between devices. Unlike hubs, which broadcast all traffic to every connected device, switches intelligently forward data only to the intended recipient. This is achieved through MAC address learning and frame forwarding, which operate at Layer 2 (Data Link Layer) of the OSI model. By dynamically mapping MAC addresses to switch ports, these devices reduce network congestion, enhance security, and optimize performance—all while remaining transparent to end users.

Key Concepts

1. MAC Addresses

48-bit hardware identifiers unique to each network interface card (NIC).
Example: AA:BB:CC:DD:EE:FF.
Used by switches to identify devices on a LAN (not to be confused with IP addresses, which operate at Layer 3).

2. CAM Table (Content-Addressable Memory Table)

A dynamic database that maps MAC addresses to switch ports.
Populated automatically as the switch learns source MAC addresses from incoming frames.

Example entry:

| MAC Address | Switch Port |
|-------------|-------------|
| AA:AA:AA    | Ethernet 0/1|

3. Frame Forwarding Methods

Method	Description	When It Occurs
Unicast	Frame is sent only to the port where the destination MAC is connected.	Destination MAC is in the CAM table.
Flooding	Frame is sent to all ports except the source port.	Destination MAC is not in the CAM table.
Broadcast	Frame is sent to all devices on the network (e.g., ARP requests).	Destination MAC is `FF:FF:FF:FF:FF:FF`.

Key Insight: Flooding is temporary. Once the switch learns all MAC addresses, traffic becomes unicast, improving efficiency.

How Ethernet Switches Operate

Core Functionality

Switches perform three primary functions:

Learning
- Inspects the source MAC address of incoming frames.
- Records the MAC address and associated port in the CAM table.
Forwarding
- Uses the destination MAC address to determine the correct port.
- Sends the frame only to the intended recipient (unicast) or floods it if unknown.
Filtering
- Prevents unnecessary traffic by not forwarding frames to irrelevant ports.
- Eliminates collisions (a common issue in hub-based networks).

MAC Address Learning Process

Switches build their CAM table dynamically. Here’s a step-by-step example:

Scenario: PC A Sends Data to PC B

Initial State: CAM table is empty.

| MAC Address | Switch Port |
|-------------|-------------|
| (empty)     | (empty)     |

PC A Sends a Frame to PC B
- Frame: Source MAC = AA:AA:AA, Destination MAC = BB:BB:BB.
- Switch Action:
  - Learns: Records AA:AA:AA → Ethernet 0/1 in the CAM table.
  - Forwards: Floods the frame to all ports except Ethernet 0/1 (since BB:BB:BB is unknown).
PC B Replies to PC A
- Frame: Source MAC = BB:BB:BB, Destination MAC = AA:AA:AA.
- Switch Action:
  - Learns: Adds BB:BB:BB → Ethernet 0/2 to the CAM table.
  - Forwards: Sends the frame only to Ethernet 0/1 (unicast).

Updated CAM Table:

| MAC Address | Switch Port  |
|-------------|--------------|
| AA:AA:AA    | Ethernet 0/1 |
| BB:BB:BB    | Ethernet 0/2 |

Network Diagram Example

A typical switch setup in a LAN:

    +---------+
    | Switch  |
    | ⇄       |  ← Bidirectional traffic flow
    +----+----+
         |
   ---------------
   |     |       |
Eth0/1 Eth0/2  Eth0/3
   |     |       |
 PC A  PC B    PC C

Common Misconceptions

❌ "Switches know all MAC addresses upfront." → Switches learn MAC addresses dynamically from incoming frames.
❌ "Flooding is the same as broadcasting." → Flooding is limited to a single switch; broadcasting sends frames to all devices on the network.
❌ "Switches operate at Layer 3." → Switches are Layer 2 devices. Routers operate at Layer 3.
❌ "Destination MAC addresses are used for learning." → Only source MAC addresses are recorded in the CAM table.

Practical Applications

1. Home Networks

Your Wi-Fi router includes a built-in switch to connect wired devices (e.g., smart TVs, gaming consoles).
Example: The first time your laptop communicates with a printer, the switch floods the frame. Subsequent prints are unicast.

2. Enterprise Networks

Large offices use managed switches to segment traffic (e.g., separating HR and Finance departments).
VLANs (Virtual LANs) logically group devices to improve security and performance.

3. Security

Switches limit eavesdropping by sending frames only to the intended port.
MAC address spoofing can exploit CAM tables, so port security features restrict device access.

Troubleshooting Tips

Issue: Devices Can’t Communicate

Check:
- Is the CAM table populated? Use:
  - Cisco: show mac address-table
  - Juniper: show ethernet-switching table
- Verify cables, port status, and MAC address conflicts.
Fix: Restart the switch or clear the CAM table (e.g., clear mac address-table dynamic on Cisco).

Issue: Excessive Flooding

Check:
- Are there loops in the network? Use Spanning Tree Protocol (STP) to prevent broadcast storms.
Fix: Ensure all switches support STP or Rapid STP (RSTP).

Advanced Topics

1. Spanning Tree Protocol (STP)

Prevents loops in redundant switch topologies by blocking redundant paths.
IEEE 802.1D standard.

2. VLANs (Virtual LANs)

Logically segment a network into isolated broadcast domains.
Example: Separating VoIP traffic from data traffic.

3. Switch Stacking

Combine multiple switches into a single logical unit for scalability.
Example: Cisco StackWise or Juniper Virtual Chassis.

4. MAC Address Aging

Switches remove stale entries from the CAM table after a timeout (default: 300 seconds).
Command to adjust aging time (Cisco): mac address-table aging-time [seconds].

Useful Commands

Vendor	Command	Purpose
Cisco	`show mac address-table`	View the CAM table.
Cisco	`clear mac address-table dynamic`	Clear learned MAC addresses.
Juniper	`show ethernet-switching table`	Display MAC address entries.
Linux	`bridge fdb show`	Inspect forwarding database entries.

Quick Summary

Switches learn MAC addresses from source addresses in incoming frames.
The CAM table maps MAC addresses to ports for efficient forwarding.
Flooding occurs for unknown destinations; unicast for known ones.
Switches operate at Layer 2 and do not modify frames.
Proper switch configuration improves performance, security, and scalability.

References

IEEE 802.3: Ethernet Standard
IEEE 802.1D: MAC Bridging (Spanning Tree Protocol)
Cisco Networking Academy: Switching Fundamentals
IETF RFC 894: Ethernet Encapsulation
Computer Networking: A Top-Down Approach (Kurose & Ross)