Cisco Switching Fundamentals — MAC learning and practical labs

An Ethernet switch connects devices inside a local network. A Layer 2 switch forwards Ethernet frames based on destination MAC addresses, not destination IP addresses.

When a frame arrives, a switch generally performs two separate operations:

1. Learn: record the frame's *source MAC address* and the incoming port in its MAC address table.
2. Forward or flood: look up the *destination MAC address* to decide which port or ports should receive the frame.

A switch does not send every frame to every device. Flooding happens when it does not know the destination, or when the frame is broadcast (and for some multicast traffic).

• MAC address: a 48-bit Layer 2 identifier, commonly displayed as AAAA.BBBB.CCCC in Cisco IOS.
• Ethernet frame: a Layer 2 unit containing source and destination MAC addresses.
• MAC address table (CAM table): learned MAC-to-port mappings, normally per VLAN.
• Known unicast: destination MAC exists in the table; the switch forwards to the associated port.
• Unknown unicast: destination MAC is not in the table; the switch floods the frame within its VLAN.
• Broadcast: destination FF:FF:FF:FF:FF:FF; flooded to other eligible ports in the same VLAN.
• ARP: IPv4 hosts use ARP requests to discover the MAC address associated with a local IPv4 address.
• VLAN: a separate Layer 2 broadcast domain.

Both PCs belong to the same subnet; no router or default gateway is required for this test.

1. PC-A checks whether 192.168.10.20 is on its local subnet.
2. If PC-A does not know PC-B's MAC, it sends a broadcast ARP request.
3. SW1 learns PC-A's source MAC on Fa0/1 and floods the ARP request out other ports in VLAN 1.
4. PC-B replies with its MAC address. SW1 learns PC-B's source MAC on Fa0/2.
5. PC-A sends ICMP Echo Requests inside unicast Ethernet frames addressed to PC-B's MAC.
6. SW1 now forwards those frames only to Fa0/2 (assuming the entry is still present).

Important: ARP is used to discover a MAC address. The switch itself learns MAC addresses by inspecting the source MAC of received Ethernet frames.

Run the command before and after the first ping. Initially the table may be empty; after traffic, it should contain the PCs' MAC addresses associated with their switch ports.

If a destination MAC is missing from the table, the switch cannot know the correct outgoing port. It sends the frame to eligible ports in the same VLAN except the ingress port. Once the destination device replies, its source MAC is learned and future frames can be forwarded as known unicasts.

MAC table entries age out after a period of inactivity; exact aging behavior depends on the platform and configuration.

When PC-A sends an ARP broadcast, SW1 floods it across the inter-switch link. SW2 receives the frame, learns PC-A's MAC on its Fa0/24, and floods it toward PC-B. The reply teaches both switches how to reach PC-B.

Each switch maintains its own MAC table. There is no single shared table between ordinary standalone switches.

A single link between SW1 and SW2 provides one Layer 2 path. Frames cannot circulate indefinitely through multiple inter-switch paths. Introducing redundant links or a triangle creates possible Layer 2 cycles, which is why Spanning Tree Protocol (STP) is important.

1. Build Lab 2 in Packet Tracer.
2. Switch from Realtime to Simulation.
3. Filter for ARP and ICMP.
4. From PC-A, run ping 192.168.10.20.
5. Use Capture/Forward and inspect the first ARP request, ARP reply, and ICMP packets.
6. Check show mac address-table on both switches.

Notice the difference between flooding a broadcast ARP request and forwarding later unicast frames.

Packet Tracer switch models may use different port names. Replace FastEthernet with GigabitEthernet where appropriate.

• Assuming a switch forwards ordinary frames based on destination IP.
• Assuming a switch learns a MAC from the destination rather than the source field.
• Confusing an ARP broadcast with an ICMP unicast.
• Assuming all unicast traffic is flooded.
• Forgetting that separate VLANs have separate broadcast domains.
• Confusing a physical redundancy problem with an IP routing problem.

1. How does SW1 learn PC-A's MAC address?
2. What does a switch do when the destination MAC is unknown?
3. Does an ARP broadcast leave its VLAN automatically?
4. Why does each of two switches need its own MAC table?
5. What new risk appears when three switches form a triangle?

Next topic: STP — how switches break a Layer 2 loop while preserving redundancy.