Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Objective 1.13 — Explain Ethernet switching behavior

An Ethernet switch builds a forwarding table by observing traffic. It does not discover the whole network in advance, and it learns from source addresses rather than destination addresses.

Source-MAC learning

When a frame arrives, the switch records the source MAC address against the ingress port and VLAN. If the source appears on a new port, the table can update to reflect movement. Learning is scoped by VLAN; the same numeric MAC in another VLAN is a separate forwarding context.

The destination MAC then drives forwarding. Learning and forwarding are two parts of the same frame-processing event.

Known-unicast forwarding

If the destination MAC exists in the table for that VLAN, the switch forwards the frame toward the associated port, subject to policy. If that port is the same as the ingress, the switch filters the frame because sending it back is unnecessary. A learned entry identifies where a source was observed, not whether the endpoint's IP configuration is valid.

Flooding

If a unicast destination is unknown, the switch floods the frame out eligible ports in the same VLAN except the ingress. Broadcast frames are also flooded in the VLAN. Relevant multicast behavior depends on features and group knowledge, but basic switching questions often begin with flooding.

Flooding is not routing. The frame remains inside its Layer 2 broadcast domain. A router or Layer 3 switch is required to cross to another IP subnet.

Aging and movement

Dynamic MAC entries age after inactivity so stale locations do not persist forever. When the next frame to an aged destination arrives, it may be flooded until the switch learns the source again. Frequent movement between ports can indicate a loop, unstable attachment, or legitimate mobility through an upstream design; context matters.

Worked trace

Host A sends a frame to unknown Host B. The switch learns A on the ingress and floods B's destination within the VLAN. B replies, causing the switch to learn B. Later A-to-B frames are known unicasts. If B's entry ages, the next A-to-B frame is flooded again, but A's source can still refresh its own entry.

Verification

Inspect the MAC table filtered by VLAN, address, or interface. Generate a frame from the endpoint and watch the source entry appear. Confirm the access VLAN and trunk allowance if the expected entry is absent. Do not use an ARP table as a substitute; ARP maps Layer 3 neighbor addresses to Layer 2 addresses, while the switch table maps MAC addresses to ports.

Common traps

• Saying the switch learns from destination MAC addresses.
• Flooding an unknown unicast to every VLAN.
• Treating a MAC entry as proof of IP reachability.
• Confusing ARP and the MAC address table.
• Assuming dynamic entries never age.

Readiness checklist

• I can trace learning and forwarding for one frame.
• I distinguish known-unicast forwarding from flooding.
• I understand VLAN scope and aging.
• I can choose MAC-table evidence for a switching complaint.