How a switch learns
A switch starts out knowing nothing about the devices plugged into it. Watch it build its MAC address table one frame at a time: it learns from every sender, floods when it is unsure, forwards straight to the right port once it knows, and forgets devices that go quiet.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01Which address does a switch use to LEARN where a device is?
The switch records the source MAC of each frame against the port it arrived on. The destination MAC is only used to decide where the frame goes.
02A frame arrives on port 1 for a MAC address that is not in the table. What does the switch do?
Unknown destinations are flooded to every other port. The right device keeps it; the others see it is not for them and drop it.
03The table already lists every device. A frame arrives addressed to ff:ff:ff:ff:ff:ff. What happens?
ff:ff:ff:ff:ff:ff is the broadcast address, meaning every device. Broadcasts are always flooded, however full the table is.
04Device C stops sending for longer than the aging time. What happens to its row?
Every frame from a MAC resets its timer. With no frames for the aging time (300 s by default) the row is removed, so the table forgets devices that left or moved.
05Host D never sends a single frame. Can the switch still deliver frames to D?
An unknown destination is flooded, so D still gets its frames. It just costs the other links a copy until D sends something and is learned.
Glossary
- MAC address
- A 6-byte hardware address of a network interface, written like 00:00:5e:00:53:01. Switches use it to find devices on the local network.
- Frame
- One message on a local network (Ethernet). Its header starts with the destination MAC, then the source MAC.
- Port
- A socket on the switch where one cable plugs in.
- MAC address table
- The switch's list of which MAC address was last seen on which port. Also called the filtering database or CAM table.
- Flooding
- Sending a copy of a frame out of every port except the one it came in on.
- Forwarding
- Sending a frame out of the single port the table says leads to its destination.
- Broadcast
- A frame sent to ff:ff:ff:ff:ff:ff, meant for every device on the local network. ARP questions use it.
- Aging time
- How long a row stays in the table without a new frame from that MAC; 300 seconds by default.
Notes and sources
- MAC addresses 00:00:5e:00:53:01-04 are RFC 7042 documentation values; ff:ff:ff:ff:ff:ff is the real broadcast address. IPs are from the private range 192.168.1.0/24 (RFC 1918).
- IEEE 802.1Q recommends an aging time of 300 s and allows 10 s to 1 000 000 s. Many switches let you change it.
- A real switch floods only within the frame's VLAN, and spanning tree may block some ports to stop loops. Here there is one VLAN and no loop.
- If a device moves to another port, its next frame simply rewrites its row with the new port.
- Frames cross a switch in microseconds; the figure slows everything down so you can watch.
Quiz Unlocks after the last step.