how/network

How a switch learns: MAC learning

A switch knows nothing at startup. In the first seconds of traffic it builds its own map, who is on which port, and stops flooding frames.

When you plug a new switch into the wall, it can switch, but it does not know who is connected to which ports. How does it start working the right way within a couple of seconds, no flooding, with targeted delivery?

The magic is the CAM table (Content-Addressable Memory). This is a table of MAC address ↔ port number that the switch learns by itself by watching the traffic passing through. Every incoming frame carries a source MAC, and the switch simply looks and records: "ah, this MAC lives on this port".

Press ▶ and watch an empty switch learn in 3 frames and go from "flood everything" mode to "targeted delivery".

step 1/5·00 · switch on, knows nothing

§ steps

The switch just booted. The CAM table is empty. It can receive and send frames, but it does not know which MACs live on which ports.

Any frame that arrives now will make it flood a copy to all ports, because the dst MAC is unknown to it.

recap

What matters to remember:

The switch learns only from the source MAC of incoming frames. It never learns from the destination MAC, because dst can be fake or a broadcast
If the destination MAC is unknown, the switch floods the frame to all ports except the incoming one (this is called unknown unicast flood). Do not confuse it with a broadcast (ff:ff:ff:ff:ff:ff). A broadcast is always flooded, it does not depend on the CAM
Entries age out (aging). Usually after 300 seconds without traffic an entry is deleted. On the next frame the switch learns again. This matters: otherwise, if a device moved between ports, it would become "unreachable"
MAC flooding attack: an attack on the switch where an attacker floods the CAM table until it overflows. The switch starts behaving like a hub, flooding all traffic to all ports. The defense is port security (limiting the number of MACs per port)
How the CAM table differs from the ARP table: the CAM lives in the switch and stores MAC ↔ port. ARP lives in the host and stores IP ↔ MAC. Different layers, different jobs

Related to arp (how a host learns a neighbor's MAC) and broadcast-domain (where the switch must flood).

§ dig into the knowledge base

§ steps

The switch just booted. The CAM table is empty. It can receive and send frames, but it does not know which MACs live on which ports.

Any frame that arrives now will make it flood a copy to all ports, because the dst MAC is unknown to it.