Cisco & Networking · Lesson 06
Switching, MAC Tables & Ethernet
Learn how Ethernet switches make forwarding decisions, how MAC addresses are learned, why frames are flooded or filtered, and how Layer 2 evidence helps isolate local network problems.
This lesson builds the switching foundation needed for VLANs, trunks, port security, and later troubleshooting. The goal is to understand what the switch knows and why it makes each decision.
Lesson Snapshot
Learning objectives
Understand how a switch decides where frames go
Explain how Ethernet frames move across a switched LAN.
Describe how a switch learns source MAC addresses and builds its MAC address table.
Distinguish unknown unicast flooding, broadcast flooding, known unicast forwarding, and filtering.
Explain collision domains, broadcast domains, duplex, and why modern switching reduces collisions.
Use Cisco IOS show commands to inspect interfaces and MAC address learning.
Troubleshoot Layer 2 connectivity before blaming routing or higher-layer services.
Core idea
Switches learn where devices are
A switch builds its forwarding knowledge by reading source MAC addresses on incoming frames. It then uses destination MAC addresses to decide where future frames should go.
Competition warning
Do not treat every unusual MAC entry as malicious
Uplinks, trunks, virtual machines, IP phones, and downstream switches can create multiple legitimate MAC addresses on one port. Always compare the table to the topology.
Core concepts
Six Layer 2 ideas to know first
Ethernet frame
A Layer 2 data unit that carries source and destination MAC addresses, an EtherType or length field, payload, and frame-check information.
MAC address
A 48-bit Layer 2 address commonly written in hexadecimal and used for local Ethernet delivery.
MAC address table
A switch table that maps learned MAC addresses to switch interfaces and VLANs.
Forwarding
Sending a frame out the interface associated with the known destination MAC address.
Flooding
Sending a frame out multiple eligible interfaces when the destination is broadcast or unknown to the switch.
Filtering
Choosing not to forward a frame out an interface when the destination is known to be on the same incoming segment or when policy prevents forwarding.
Ethernet frame
What the switch sees at Layer 2
Preamble / SFD
Helps receiving Ethernet devices synchronize and identify the beginning of the frame.
Destination MAC
Identifies the intended Layer 2 destination for this local Ethernet hop.
Source MAC
Identifies the Layer 2 source of the frame and is the address a switch learns from.
EtherType / Length
Identifies the encapsulated upper-layer protocol or provides frame-length information depending on Ethernet format.
Payload
Carries upper-layer data such as an IPv4 packet.
FCS
Provides error-detection information so corrupted frames can be identified.
Layer 2 changes at routed boundaries
When a packet crosses a router, the router removes the incoming Layer 2 frame and builds a new frame for the next link. The IP packet continues toward the remote destination while local MAC addressing changes hop by hop.
MAC learning
How the switch builds its forwarding table
Frame enters a switch port
The switch receives an Ethernet frame on one interface.
Switch reads the source MAC
The source MAC tells the switch where that device can currently be reached.
Switch updates its MAC table
The switch associates the source MAC with the incoming interface and VLAN.
Switch checks the destination MAC
If the destination is known, the switch forwards only toward the matching interface.
Unknown destinations are flooded
If the destination MAC is not yet known, the switch floods the frame to eligible ports in the same VLAN except the port it arrived on.
Future traffic becomes more targeted
As devices communicate, the switch learns more source MAC addresses and can forward more frames directly.
Traffic behavior
Forward, flood, or filter
Known unicast
A specific MAC address already present in the MAC table.
Forward out the learned destination interface.
Unknown unicast
A specific MAC address not currently in the MAC table.
Flood to eligible ports in the same VLAN except the incoming port.
Broadcast
FF:FF:FF:FF:FF:FF
Flood to eligible ports in the same VLAN except the incoming port.
Multicast
A Layer 2 multicast MAC address.
Behavior depends on switch features and multicast awareness; basic switching may flood within the VLAN.
MAC address types
Not every MAC entry means the same thing
Unicast MAC
Represents one Layer 2 interface and is used for one-to-one Ethernet delivery.
Broadcast MAC
FF:FF:FF:FF:FF:FF reaches all devices in the local broadcast domain.
Multicast MAC
Represents a group of interested receivers rather than one individual interface.
Static MAC entry
Manually configured table entry that does not depend on ordinary dynamic learning.
Dynamic MAC entry
Learned automatically from source MAC addresses seen on incoming frames.
Ethernet behavior
Collision domain
A network segment where simultaneous transmissions could interfere under shared, half-duplex Ethernet. Modern switched full-duplex links isolate collision domains per switch port.
Ethernet behavior
Broadcast domain
The set of devices that receive a Layer 2 broadcast. VLANs divide a switch into separate broadcast domains.
Ethernet behavior
Full duplex
Allows sending and receiving simultaneously on a point-to-point link and avoids classic Ethernet collisions.
Ethernet behavior
Half duplex
Older/shared behavior where a device cannot transmit and receive at the same time and collisions can occur.
Forwarding examples
Predict the switch decision
Host A sends to Host B, and Host B is already learned on Gi0/2.
The switch forwards the frame only out Gi0/2.
The destination MAC has a known table entry.
Host A sends to a new Host C whose MAC is not in the table.
The switch floods the frame within the VLAN except back out Host A's port.
The destination MAC is unknown.
Host A sends an ARP request using the broadcast MAC.
The switch floods the frame throughout the local VLAN.
ARP requests commonly use Layer 2 broadcast so the intended IPv4 owner can respond.
Host A sends to a destination learned on the same incoming port.
The switch filters the frame instead of forwarding it elsewhere.
The destination is already reachable on the same local segment.
Cisco inspection
Read the switch before changing it
show mac address-tableDisplay learned and static MAC addresses, VLAN associations, and interfaces.
show mac address-table dynamicDisplay dynamically learned MAC entries on supported switches.
show mac address-table address <mac>Find the interface and VLAN associated with one MAC address where supported.
show mac address-table interface <interface>Display MAC entries learned through a selected interface.
show interfaces statusSummarize port status, VLAN, duplex, speed, and interface type on supported switches.
show interfaces <interface>Review detailed interface state, errors, counters, duplex, speed, and line status.
show vlan briefConfirm VLAN existence and access-port membership.
show interfaces switchportReview switchport mode, access VLAN, trunk-related state, and other Layer 2 details on supported IOS platforms.
IOS output varies by platform
Some Packet Tracer switch models expose fewer commands or fields than real Cisco IOS devices. Use the closest supported inspection command and do not assume missing output means the concept does not exist.
Interface counters
Error counters are clues, not automatic diagnoses
Input errors
General receive-side errors that can point to physical or link problems.
CRC errors
Frame-check failures often associated with corruption, cabling, interference, or duplex-related issues.
Runts
Frames smaller than the minimum valid Ethernet frame size.
Giants
Frames larger than the expected maximum for the configured environment.
Collisions
Relevant mainly in half-duplex/shared Ethernet environments; persistent collisions on modern full-duplex links deserve investigation.
Late collisions
Can indicate duplex problems or physical-layer issues in Ethernet environments where collisions are possible.
Input drops
Frames discarded because buffers or processing resources could not handle the load.
Output drops
Frames discarded before transmission, often associated with congestion or queue limitations.
Speed and duplex
Keep both ends of the Ethernet link consistent
Auto-negotiation
Ethernet devices commonly negotiate speed and duplex automatically. Both ends should normally agree.
Duplex mismatch
One side operating full duplex while the other operates half duplex can cause poor performance and error symptoms.
Speed mismatch
Depending on media and platform, mismatched speed settings can prevent the link from coming up or cause connectivity problems.
Do not hard-code casually
Manual settings should match the intended design on both ends. Changing only one side can make the problem worse.
ARP and switching
IPv4 neighbor discovery creates useful Layer 2 evidence
Host knows a destination IPv4 address
The host determines whether the destination is local or remote.
Host needs a local next-hop MAC
For a same-subnet destination, it needs the destination host MAC. For a remote subnet, it needs the default gateway MAC.
ARP request is broadcast
The sender asks which local device owns the target IPv4 address.
ARP reply is usually unicast
The owner returns its MAC address to the requester.
Switch learns from both directions
As frames cross the switch, source MAC addresses populate the switch MAC table.
Future frames can be forwarded directly
The host has neighbor information and the switch has Layer 2 forwarding information.
VLAN context
Switching decisions happen inside a broadcast domain
MAC tables are VLAN-aware
A switch normally tracks MAC addresses in the context of a VLAN because each VLAN is a separate Layer 2 broadcast domain.
Same MAC can appear in different VLAN contexts
Virtualized or multi-interface environments can create cases where the same underlying system identity appears in multiple logical segments.
Flooding stays within the VLAN
An unknown unicast or broadcast in VLAN 10 should not automatically flood into VLAN 20.
Routing is needed between VLANs
A Layer 3 device or Layer 3 switch function must route traffic between separate VLAN broadcast domains.
MAC aging
Learned location is temporary evidence
Dynamic entries age out
Switches remove dynamic MAC entries after a period of inactivity so stale location information does not remain forever.
Traffic refreshes learning
When a source MAC sends again, the switch refreshes the learned location.
Clearing a table is disruptive to evidence
The network may relearn quickly, but clearing entries removes useful troubleshooting evidence and can trigger temporary flooding.
Do not clear just to 'fix' uncertainty
If a MAC entry looks suspicious, investigate why it is present before deleting evidence.
Troubleshooting
Use Layer 2 symptoms to choose the next check
Host has no link light and switch interface shows down/down
Likely layer
Physical
Cable, interface selection, power, adapter state, physical connection, speed compatibility.
Interface is up/up but no MAC address is learned from the endpoint
Likely layer
Layer 2 / endpoint
Endpoint activity, VLAN, cabling path, NIC state, wrong physical port, port security.
MAC is learned on the wrong switch port
Likely layer
Topology / cabling
Physical patching, uplinks, unexpected intermediate switch, moved endpoint.
Two same-VLAN hosts cannot communicate
Likely layer
Layer 2 or endpoint addressing
VLAN membership, MAC learning, local firewall, duplicate IP, wrong mask, port security.
Broadcast reaches some hosts but not others
Likely layer
VLAN boundary / switchport configuration
Access VLAN, trunk allowance, VLAN existence, topology path.
Link works but performance is extremely poor
Likely layer
Interface quality / duplex / congestion
CRC errors, collisions, drops, duplex, speed, queueing, cable quality.
Reading the MAC table
What table patterns can tell you
MAC 00AA.BBCC.DD01 appears on Gi0/5 in VLAN 10
The switch currently believes that MAC is reachable through Gi0/5 within VLAN 10.
The same MAC moves rapidly between Gi0/5 and Gi0/24
This may indicate a loop, a moving endpoint, virtualization behavior, or an unexpected topology. Investigate before changing ports.
No MACs appear on a supposedly active access port
The endpoint may not be sending frames, the wrong port may be documented, or the physical/link configuration may be wrong.
Many MACs appear on one uplink or trunk port
This can be normal because that link may lead to another switch carrying many devices.
One access port has multiple MAC addresses
This can indicate a downstream switch, phone-plus-PC design, virtualization, or unauthorized sharing depending on the scenario.
Evidence-based reasoning
Do not confuse normal switching behavior with a fault
A switch receives a frame for a destination MAC not in its table
Weak response
Drop it because the destination is unknown.
Better reasoning
A basic switch floods unknown unicast traffic within the VLAN so the destination has a chance to receive it.
One uplink port shows dozens of learned MAC addresses
Weak response
Disable it because one port should have one MAC.
Better reasoning
Uplinks and trunks can legitimately carry traffic for many downstream devices. Confirm the topology and port role.
A host can ping its gateway but not another host in the same VLAN
Weak response
The router must be blocking the traffic.
Better reasoning
Same-VLAN traffic should not require routing. Inspect switchport membership, MAC learning, host addressing, and endpoint security.
A port has CRC errors
Weak response
Reconfigure VLANs.
Better reasoning
CRC errors point first toward physical/link-quality issues, cable problems, interface faults, or duplex-related symptoms.
The switch MAC table does not list a quiet workstation
Weak response
The workstation is not connected.
Better reasoning
Dynamic MAC entries can age out. Generate authorized traffic or inspect link state before concluding the host is absent.
A broadcast frame reaches all hosts in VLAN 10
Weak response
The switch is malfunctioning because it should forward to only one port.
Better reasoning
Broadcast flooding within the VLAN is expected Layer 2 behavior.
Unsafe shortcuts
Layer 2 changes that can erase evidence or break the LAN
Clearing the entire MAC address table during troubleshooting
Removes evidence and increases temporary unknown-unicast flooding while the switch relearns devices.
Disabling a port because it has many MAC addresses
The port may be a legitimate uplink, trunk, virtualization host, or phone-plus-PC connection.
Changing VLAN membership before checking the topology
Can move required endpoints into the wrong broadcast domain and break connectivity.
Hard-coding speed or duplex on only one side
Can create link failure or duplex mismatch symptoms.
Assuming Layer 2 is working because the interface is up
An up/up port can still have wrong VLAN, port-security, MAC-learning, or physical quality problems.
Blaming routing for same-subnet communication failures
Wastes time and can lead to unnecessary Layer 3 changes when the problem is local switching or endpoint configuration.
Verification
Prove the switch knows the expected topology
Physical link
Required switch ports are connected and operational.
VLAN context
Endpoints belong to the intended VLAN and broadcast domain.
MAC learning
Expected source MAC addresses appear on the correct interfaces.
Interface quality
Error counters do not indicate a persistent cable, duplex, or congestion problem.
Local communication
Same-VLAN hosts can communicate without requiring unnecessary routing changes.
Topology consistency
High-MAC-count ports and uplinks match the documented network design.
Defensive lab
Observe MAC learning in a fictional switched LAN
Build a fictional LAN with one switch and three PCs in the same VLAN and subnet.
Before generating traffic, inspect the switch MAC table and record what entries exist.
Ping from PC-A to PC-B and watch the ARP and ICMP exchange in Packet Tracer simulation mode.
Recheck the MAC table and identify which source MAC addresses were learned and on which interfaces.
Generate traffic to PC-C before its MAC is learned and observe unknown-unicast or discovery behavior where visible in the simulation.
Move one PC to a different access port and observe how the switch updates its learned MAC location after new traffic.
Introduce one fictional fault such as wrong VLAN membership or disabled endpoint NIC and use show commands to isolate it.
Correct only the confirmed fault, verify same-VLAN connectivity, and document the before-and-after MAC table evidence.
Lesson checklist
Before moving on
I can explain what an Ethernet frame carries.
I know that switches learn from the source MAC address.
I can distinguish known unicast, unknown unicast, broadcast, and multicast behavior.
I understand why unknown unicast and broadcast traffic are flooded within a VLAN.
I know that a switch MAC table maps MAC addresses to interfaces and VLANs.
I understand the difference between collision domains and broadcast domains.
I can explain why modern full-duplex switched Ethernet avoids classic collisions.
I can inspect MAC learning with Cisco IOS show commands.
I can interpret basic interface error counters.
I do not disable a high-MAC-count port without understanding its role.
I troubleshoot same-VLAN failures at Layer 2 before changing routes.
I verify switch state and endpoint connectivity after Layer 2 changes.
Reflection
Check your reasoning
Question 1
Why does a switch learn from the source MAC address instead of the destination MAC address?
Question 2
What happens when a switch does not know the destination MAC address?
Question 3
Why can one uplink legitimately show many learned MAC addresses?
Question 4
What is the difference between a collision domain and a broadcast domain?
Question 5
Why might a quiet host disappear from the dynamic MAC address table?
Question 6
What Layer 2 evidence should you collect before changing a switchport VLAN?
Carry this forward
Read the MAC table together with the topology, VLAN, and interface state. One table entry rarely tells the whole story, but combined Layer 2 evidence can quickly show where local traffic is really moving.