Ethernet LAN Switching: How Layer-2 Switches Learn MAC Addresses & Forward Frames

How does an Ethernet switch know which physical port leads to which computer without any manual IP configuration? Here is the exact IEEE 802.1D switching logic every CCNA candidate needs to master.

---

When you unpack a Layer-2 Ethernet switch and plug four computers into ports Fa0/1 through Fa0/4, the switch begins forwarding frames immediately—even before you open a console cable or configure a single line of Cisco IOS CLI.

Unlike a legacy Layer-1 hub (which blindly repeats electrical signals out of every port and places all connected hosts into a single collision domain), a modern Layer-2 switch makes intelligent, hardware-accelerated forwarding decisions for every individual Ethernet frame using a MAC Address Table (also called a CAM — Content Addressable Memory table). Each switch port forms its own independent collision domain while remaining in the same Layer-2 broadcast domain (unless segmented by VLANs).

In this guide, we examine the structure of an IEEE 802.3 / Ethernet II frame, the structure of a 48-bit MAC address, the four core actions of a Layer-2 switch (Learn, Flood, Forward, Filter), and how to inspect MAC tables live in the Web Packet Tracer & Network Simulator.

---

1. Anatomy of an Ethernet II Frame & 48-bit MAC Address

The Ethernet Frame Structure (IEEE 802.3 / DIX Ethernet II)

Before bits travel across a LAN link, the network interface card (NIC) encapsulates the Layer-3 packet (IPv4, IPv6, or ARP) inside an Ethernet frame:

+-------------------+------------------+------------------+---------------+-----------------------+---------+
| Preamble + SFD    | Destination MAC  | Source MAC       | EtherType     | Payload (Packet/Data) | FCS     |
| 7 Bytes + 1 Byte  | 6 Bytes (48-bit) | 6 Bytes (48-bit) | 2 Bytes       | 46 to 1500 Bytes      | 4 Bytes |
+-------------------+------------------+------------------+---------------+-----------------------+---------+
|◄─ L1 Sync        ─►|◄─────────────── Layer 2 Header (14B) ──────────────►|◄─── L3 PDU ──────────►|◄─ L2  ─►|

• Preamble (7 bytes, 10101010...) & Start Frame Delimiter / SFD (1 byte, 10101011): Used at Layer 1 so the receiving NIC clock synchronizes with the incoming bit stream before the frame header begins.
• Destination MAC Address (6 bytes / 48 bits): Identifies the recipient NIC (unicast), a group of NICs (multicast, 01:00:5E:...), or all devices on the local broadcast domain (broadcast, FF:FF:FF:FF:FF:FF).
• Source MAC Address (6 bytes / 48 bits): Identifies the sending NIC that transmitted the frame onto the local link.
• EtherType (2 bytes): Values >= 0x0600 (1536 decimal) indicate the encapsulated Layer-3 protocol (0x0800 for IPv4, 0x0806 for ARP, 0x86DD for IPv6). Values <= 1500 (0x05DC) indicate an IEEE 802.3 Length field.
• Payload (46–1500 bytes): The encapsulated Layer-3 packet. Because the minimum Ethernet frame size (from Destination MAC through FCS) is 64 bytes (minus the 14-byte header and 4-byte FCS = 46 bytes), payloads smaller than 46 bytes (such as a 28-byte ARP packet) are padded with zeros.
• FCS (Frame Check Sequence, 4 bytes): A 32-bit CRC checksum calculated over the frame fields.

Structure of a 48-bit MAC Address

A Media Access Control (MAC) address is a 48-bit (6-byte) physical hardware identifier written as 12 hexadecimal digits:

• Standard / Windows / Linux format: 00:1A:2B:3C:4D:5E or 00-1A-2B-3C-4D-5E
• Cisco IOS dotted-quad hex format: 001a.2b3c.4d5e

The 48 bits are split into two 24-bit (3-byte) halves:

1. OUI (Organizationally Unique Identifier — first 24 bits / 6 hex digits): Assigned by the IEEE to the hardware vendor (or marked as locally administered when the second hex digit has bit 1 set, such as 02:00:00:...).
2. Vendor Assigned / NIC Specific (last 24 bits / 6 hex digits): Uniquely assigned by the manufacturer to that specific interface.

If you want to practice converting hexadecimal MAC bytes to binary or decimal, try the Number Base Converter.

---

2. The Four Actions of a Layer-2 Switch

Every time an Ethernet frame enters an active switch port, the switch performs two independent stages:

1. Stage 1 (Examine Source MAC $\rightarrow$ Learn): Update the MAC Address Table.
2. Stage 2 (Examine Destination MAC $\rightarrow$ Flood, Forward, or Filter): Decide which port(s) should transmit the frame.

Action 1: Learn (Source MAC Address)

When a frame enters port Fa0/1, the switch reads the Source MAC address in the Ethernet header:

• If that Source MAC is not in the MAC address table, the switch adds a DYNAMIC entry mapping Source MAC -> Fa0/1.
• If the Source MAC is already in the table on a different port (because a host moved cables), the switch updates the port mapping immediately.
• On real Cisco Catalyst switches, dynamic MAC entries have an aging timer of 300 seconds (5 minutes) by default; every new frame from that Source MAC resets the timer back to 0.
• Important: A switch never learns a MAC address from the Destination MAC field! Until a host transmits at least one frame, the switch does not know where that host lives.

Action 2: Flood (Broadcasts & Unknown Unicasts)

Next, the switch inspects the Destination MAC address:

• Broadcast Frame (FF:FF:FF:FF:FF:FF): Such as an ARP Request or DHCP Discover. The switch floods a copy of the frame out of all active ports in the same VLAN except the ingress port it arrived on.
• Unknown Unicast Frame: The Destination MAC is a unicast address, but that MAC is not currently in the switch's MAC address table. Because the switch does not know which port leads to the destination, it floods the frame out of all active ports except the ingress port.

Action 3: Forward (Known Unicast)

If the Destination MAC address is found in the MAC address table (for example, mapped to Fa0/2) and Fa0/2 is different from the ingress port (Fa0/1), the switch sends the frame exclusively out of Fa0/2. No other ports on the switch receive the frame.

Action 4: Filter (Same-Port Unicast)

If a frame arrives on Fa0/1 and the MAC address table shows that the Destination MAC is also located on Fa0/1 (which can happen if two hosts share an old hub or wireless bridge connected to Fa0/1), the switch filters (drops) the frame because the destination already received it on that physical segment.

---

3. Hands-On Lab: Watching MAC Learning in Web Packet Tracer

Let us verify these exact switch operations using the Web Packet Tracer:

1. Open Web Packet Tracer and click Load Sample Topology.
2. Click on switch SW1 on the canvas to open its Cisco IOS CLI console tab.
3. Before sending any traffic, inspect SW1's MAC address table:

   SW1> enable
   SW1# show mac address-table
             Mac Address Table
   -------------------------------------------
   Vlan    Mac Address       Type        Ports
   ----    -----------       --------    -----
   Total Mac Addresses for this criterion: 0
   

   Notice that the table starts with 0 entries!
4. Now switch the top toolbar to Step Mode and click Ping Demo (PC1 → 10.0.0.10).
5. Click Step Forward once (PC1 (eth0) → SW1 (Fa0/1)):
   • PC1 transmits an ARP Request broadcast (dstMac: FF:FF:FF:FF:FF:FF) asking for its default gateway (192.168.1.1).
6. Click Step Forward a second time so SW1 processes the frame and floods it out Fa0/2 toward R1 (Gi0/0). Now run show mac address-table on SW1 again:

   SW1# show mac address-table
             Mac Address Table
   -------------------------------------------
   Vlan    Mac Address       Type        Ports
   ----    -----------       --------    -----
      1    02:00:00:00:00:01 DYNAMIC     Fa0/1
   Total Mac Addresses for this criterion: 1
   

   SW1 learned PC1's MAC address on Fa0/1 from the incoming ARP Request's Source MAC, and flooded the frame out Fa0/2 because the Destination MAC was FF:FF:FF:FF:FF:FF.
7. Click Step Forward again so R1 sends its unicast ARP Reply back to SW1 (Fa0/2). Now run show mac address-table on SW1:
   • Both Fa0/1 (PC1) and Fa0/2 (R1 Gi0/0) are now populated as DYNAMIC entries! Every subsequent ICMP Echo Request and Echo Reply is forwarded unicast directly between Fa0/1 and Fa0/2 with zero flooding.
8. To reset the switch's learned entries and re-test unknown unicast flooding, run:

   SW1# clear mac address-table
   SW1# show mac address-table
   

---

4. Legitimate Sources & Standards References

• IEEE Std 802.1D: IEEE Standard for Local and Metropolitan Area Networks: Media Access Control (MAC) Bridges (Defines transparent bridging, dynamic source MAC learning, forwarding, filtering, and flooding).
• IEEE Std 802.3: IEEE Standard for Ethernet (Defines the Ethernet frame format, MAC addressing, and FCS CRC-32 error detection).
• Cisco IOS LAN Switching Command Reference: show mac address-table and clear mac address-table dynamic command specifications.
• Cisco CCNA 200-301 Exam Topics (v1.1): Domain 2.0 Network Access (Frame switching, MAC learning and aging, frame flooding, MAC address table).

---

5. CCNA 200-301 Exam Prep: Questions & Detailed Answers

Question 1

A Cisco Catalyst switch has just booted up with an empty MAC address table. Host A (connected to Fa0/1) sends a unicast Ethernet frame addressed to Host B (connected to Fa0/3). What two actions will the switch take?

• A. It drops the frame and sends an ARP Request for Host B.
• B. It records Host A's MAC address on Fa0/1 in the MAC address table, and floods the frame out of all active ports in the VLAN except Fa0/1.
• C. It records Host B's MAC address on Fa0/3, and forwards the frame only out of Fa0/3.
• D. It floods the frame out of all active ports including Fa0/1 without updating the MAC address table.

Correct Answer: B
Explanation: First, the switch inspects the Source MAC of the incoming frame and learns that Host A resides on Fa0/1. Second, it looks up the Destination MAC (Host B) in its MAC address table. Because the table was empty, Host B's MAC is not found (an unknown unicast). A Layer-2 switch floods unknown unicast frames out of all active ports in that VLAN except the ingress port (Fa0/1). Switches do not generate ARP requests on behalf of switched Layer-2 frames.

---

Question 2

What is the default aging timer for dynamic entries in the MAC address table on a Cisco IOS Catalyst switch?

• A. 60 seconds (1 minute)
• B. 180 seconds (3 minutes)
• C. 300 seconds (5 minutes)
• D. 14,400 seconds (4 hours)

Correct Answer: C
Explanation: On Cisco Catalyst switches, dynamically learned MAC address table entries age out after 300 seconds (5 minutes) of inactivity (no frames received with that Source MAC address). Note: 14,400 seconds (4 hours) is the traditional default Cisco IOS ARP cache timeout on routers, a classic CCNA exam distractor.

---

Question 3

Which field in an Ethernet frame does a Layer-2 switch use to populate its MAC address table, and which field does it use to make its forwarding decision?

• A. Populate: Destination MAC; Forward: Source MAC
• B. Populate: Source MAC; Forward: Destination MAC
• C. Populate: Source IP; Forward: Destination MAC
• D. Populate: Source MAC; Forward: Destination IP

Correct Answer: B
Explanation: A switch always populates (learns) its MAC address table using the Source MAC address and ingress port of incoming frames, and always makes its forwarding/flooding decision by looking up the Destination MAC address in the MAC address table.

---

Question 4

How many collision domains and how many broadcast domains exist on an 8-port Layer-2 switch (with default VLAN 1 configuration) that has 6 PCs connected to Fa0/1–Fa0/6 and 1 Router interface connected to Fa0/8?

• A. 1 collision domain, 1 broadcast domain
• B. 7 collision domains, 1 broadcast domain
• C. 1 collision domain, 7 broadcast domains
• D. 7 collision domains, 7 broadcast domains

Correct Answer: B
Explanation: Every active port on a Layer-2 switch breaks up collision domains—so 7 connected switch ports (Fa0/1–Fa0/6 plus Fa0/8) create 7 independent collision domains. However, a Layer-2 switch floods broadcasts across all ports in the same VLAN, and the router stops broadcasts at Fa0/8, meaning all 7 links share 1 broadcast domain.

---

Question 5

What happens when a Layer-2 Ethernet switch detects that a received frame's 32-bit Frame Check Sequence (FCS) does not match the calculated CRC?

• A. The switch sends an ICMP Parameter Problem message back to the sender.
• B. The switch requests a Layer-2 retransmission from the previous switch.
• C. The switch silently discards (drops) the corrupted frame and increments the interface input error/CRC counter.
• D. The switch floods the frame out all ports with an error bit set.

Correct Answer: C
Explanation: Ethernet (IEEE 802.3) is a best-effort Layer-2 protocol with error detection (via FCS/CRC), not Layer-2 error recovery. In store-and-forward switching, if a frame fails the FCS check, the switch silently drops the frame and increments the interface CRC and input errors counters. Any retransmission is handled by upper-layer protocols such as TCP (Layer 4) or application retries.