MAC Address Tables and How Switches Forward Frames

You plug a new laptop into Gi0/5. First ping floods, second ping is instant. Nothing changed — the switch just learned. This lesson is those 2 seconds: how a switch goes from 'never seen you' to 'know exactly where you are'.

That's the switch's entire worldview. Every DYNAMIC entry got there by watching a source MAC arrive on a port. STATIC entries, like that multicast `0100.5e...` bound to CPU, were pre-programmed — usually by a protocol like IGMP snooping or STP.

#Learning, Forwarding, Flooding, Filtering#link

1. Learning — source MAC is recorded against the ingress port
2. Forwarding — destination MAC is in the table, send out exactly one port
3. Flooding — destination unknown or is broadcast/multicast, send out every port in the VLAN except ingress
4. Filtering — destination MAC is on the same port the frame arrived from, drop it

Filtering looks odd until you remember switches are often cabled to hubs or unmanaged switches. If a frame arrives on Gi0/1 with a destination MAC that the switch believes lives on Gi0/1, it's a device behind the hub talking to another device behind the same hub — the switch has no reason to re-flood it.

#Building the Table — a Walkthrough#link

Imagine four hosts connected to Gi0/1 through Gi0/4, just powered on. The switch has an empty MAC table. Host A sends an ARP for its gateway. Here's what happens:

One ARP round trip, and the switch already learned two entries. On a busy access port, the table fills up in seconds. That's why a MAC address table overflow attack — flooding the table with bogus source MACs — is such a common vector: once the table is full, the switch falls back to flooding every frame, and anyone on the VLAN can sniff traffic that should be unicast.

#Troubleshooting: Stale Entries#link

You moved a laptop from one access port to another. The switch still thinks the laptop's MAC lives on the old port, so traffic floods until the entry ages out or a new frame updates it. This is why moves go wrong for a few seconds.

If you expected this MAC on Gi0/5 and it shows Gi0/1, either the device moved and hasn't sent a frame yet, or something is spoofing it. Check `show interfaces Gi0/1` for recent activity and look at the last-seen time via the aging counter.

#Quick Check#link

The MAC table is the switch's entire state. When forwarding looks broken, dump the table first — nine times out of ten the problem is a stale entry or a MAC that's been spoofed. Overflow attacks that fill this table (so the switch floods everything) are stopped with port-security — full detail in Module 15.