Starting empty
A switch joins devices with cables, one per port. Every device has a MAC address, an ID built into its network hardware. This switch was just turned on, so its MAC address table, the list of which MAC sits behind which port, is empty.
Unknown destination
A wants to reach B, so it sends a frame: one message on the local network. Its header starts with two MAC addresses, the destination (B) and then the source (A). It enters the switch on port 1.
The switch reads the source MAC first. A's frame came in on port 1, so A can be reached through port 1. It writes that row into its table and starts a 300-second timer.
B is not in the table yet, so the switch floods: it sends a copy out of every port except the one the frame came in on. B keeps it. C and D see it is not for them and drop it.
Known destination
B answers A. The reply carries B's MAC as its source and arrives on port 2, so the switch learns a second row: B is behind port 2.
A is already in the table, on port 1. So the switch sends the reply out of port 1 only. C and D never see it, and their cables stay quiet.
Broadcast
C sends a broadcast: a frame addressed to ff:ff:ff:ff:ff:ff, which means every device here. An ARP question ("who has this IP address?") is one. The switch still learns from the source: C is behind port 3.
A broadcast is meant for everyone, so the switch always floods it, however full its table is. Ports 1, 2 and 4 each get a copy, and A, B and D all keep it.
Steady state
A sends B another frame. The switch already knows A is on port 1, so learning just resets A's timer back to 300 seconds.
B is in the table too, so the frame leaves through port 2 alone. From now on, frames between devices the switch knows go only where they need to.
Each row has a timer. Every frame from that MAC resets it; if none arrives for the aging time, 300 seconds by default, the row is deleted. A and B keep talking, but C goes quiet, so C's row expires.
Inside the switch
;; step 1/11 · empty-table · idle MAC address table (filtering database) MAC address port timer (no entries) ports 1-4 up · one VLAN · aging time 300 s (IEEE 802.1Q default)
A real switch floods only within the frame's VLAN, and spanning tree may block some ports to stop loops. Here there is one VLAN and no loop. If a device moves to another port, its next frame simply rewrites its row with the new port.