How a Switch Learns Where to Send a Frame

A switch remembers which port each source address came from, and floods when it does not know yet.

A switch connects many devices on one network and sends each frame only out of the port that leads to its destination. It learns which port that is by reading the source MAC address of every frame it receives, and when it does not know a destination yet, it sends the frame out of every port except the one it arrived on.

Picture an office switch with four ports, plugged into four computers called A, B, C and D. When it is switched on, its table of MAC addresses is empty: it knows nothing about who sits where.

A clerk in a post room is a fair comparison. Each time a letter is handed in, the clerk notes which desk the sender sits at from the return address, and delivers later letters for that sender straight to the desk. The comparison breaks on an unknown name: a clerk would ask around, but a switch copies the frame to every desk at once and lets the wrong ones ignore it.

Three frames through a four-port switch, with its MAC table after each

InputAn empty MAC table; A on port 1, B on port 2, C on port 3, D on port 4

Frame 1: A to B
1. A: port 1learned
The switch learns A from the source address. B is unknown, so the frame floods out of ports 2, 3 and 4.
Frame 2: B to A
1. A: port 1
2. B: port 2learned
The switch learns B. A is known, so the frame goes out of port 1 only; C and D never see it.
Frame 3: A to everyone
1. A: port 1
2. B: port 2
The destination is the broadcast address, so the frame floods out of ports 2, 3 and 4 whatever the table holds.

ResultThe table fills from source addresses alone, and only known, single destinations escape flooding.

Three rules cover everything a switch does with a frame. A known destination goes out of one port. An unknown destination, or the broadcast address, goes out of every port but the incoming one. The source address is always recorded, so the table keeps up as devices move. Entries also expire after a few minutes of silence, commonly five, so a laptop moved to another port is relearned.

A switch never reads an IP address to make these choices, which is why it is a layer 2 device and why it cannot send a frame to another network. A router does that.

Flooding the first frame to a new address is normal. A switch that floods constantly is a symptom: its table is full, or two switches form a loop.

So when a computer receives traffic that is not addressed to it, or a whole network slows down at once, look at the switches' MAC tables before anything else.

← → move through sections and cards