6.7 MAC Learning

Introduction

In an Ethernet network, switches need to know which devices are reachable on which ports. This process is called MAC learning. It is what allows a switch to forward frames intelligently instead of flooding everything everywhere. In this chapter you will see how a switch learns MAC addresses, how it stores them, and what it does when it does not know where a device is yet.

MAC Address Tables

Each Ethernet switch keeps a table in memory that maps MAC addresses to switch ports. This table is often called the MAC address table, CAM table, or forwarding table. Conceptually, it looks like a simple list of entries.

A typical MAC table entry includes at least:

The switch consults this table for every frame it forwards on a given VLAN. The table is per VLAN, so the same MAC address can appear once in VLAN 10 and again in VLAN 20, often on different ports.

How Dynamic MAC Learning Works

The switch learns MAC addresses by watching the source MAC address of every Ethernet frame that arrives on its ports. It does not need any special protocol. The learning is automatic and continuous.

The basic logic for learning is simple:

1. A frame arrives on port X in VLAN V.
2. The switch looks at the source MAC address in the frame.
3. It records or updates the entry: “source MAC is reachable via port X in VLAN V.”

You can think of it as the switch taking notes any time it sees traffic, so it can remember where a device is located. This learning happens even if the frame is not ultimately intended for that switch. The important part is that the switch examines all frames that enter a port.

If an entry already exists for that MAC address on the same VLAN but with a different port, the switch updates the entry to the new port. This is how switches adapt if a device moves, or if a link fails and traffic appears on another path.

Forwarding Decisions with Learned MACs

MAC learning alone does not move frames. It only builds the knowledge. The switch uses this knowledge when it needs to decide where to send a frame. For each frame, after learning from the source MAC, the switch looks at the destination MAC and checks its table.

At a high level:

• If the destination MAC is found in the table on that VLAN, the switch forwards the frame to the specific port listed.
• If the destination MAC is not in the table, the switch floods the frame out all ports in that VLAN except the one where it was received.
• If the destination MAC is a broadcast or certain multicast address, the switch also floods within that VLAN.

This behavior depends on collision and broadcast domains, and will be connected to broadcast domains in another chapter. Here you only need to see that MAC learning reduces unnecessary flooding. When a MAC table is well populated, most frames are unicast and forwarded out only one port.

Flooding and the Learning Phase

When a switch first powers on, its MAC table is empty. At this point it does not yet know where any device is. The first frames it receives will trigger learning of source MACs, but the corresponding destination MACs may not be known yet.

For example, imagine host A and host B are connected to two ports of a switch:

1. Host A sends a frame to host B.
2. The frame arrives on port 1 with source MAC A and destination MAC B.
3. The switch learns: MAC A is on port 1 in VLAN X.
4. The switch checks its table for MAC B and finds no entry.
5. Because MAC B is unknown, the switch floods the frame out all other ports in VLAN X.
6. The frame reaches host B on port 2.
7. When B replies, the switch now learns that MAC B is on port 2.

From that point on, frames between A and B can be forwarded directly without flooding. This initial period while MAC addresses are still being learned can be seen as the learning phase of the network.

Aging and MAC Table Timeouts

MAC tables cannot grow forever. Devices can be turned off, moved to other ports, or removed. To handle this, switches use an aging mechanism. Each dynamic MAC entry has an associated timer. Whenever traffic from that MAC address is seen, the timer is refreshed. If no frames from a given source MAC are seen for a period of time, the entry is removed.

A typical default aging time on many switches is around 300 seconds, or 5 minutes, but this can vary by vendor and configuration.

If an entry ages out and the device later sends traffic again, the switch simply relearns it from the next frame it receives. Aging keeps the MAC table accurate and prevents it from filling with old, unused entries.

Without aging, the MAC table would eventually become stale and would no longer reflect the true location of devices in the network.

Static MAC Entries

Most MAC entries are dynamic, learned from traffic. However, it is possible to define static MAC entries manually on a switch. A static entry maps a specific MAC address to a specific port and VLAN and never ages out.

Static MAC entries can be useful in some special cases, such as:

• Very important devices that must always be reachable on a known port.
• Situations where you want to tightly control which MACs can appear on a port, combined with security features that you will see elsewhere.

Static entries do not participate in the normal age and relearn cycle. If a device with that MAC is moved to a different port, a static entry will not automatically update. The administrator must change it manually, so static entries are normally used sparingly.

MAC Learning and VLANs

When VLANs are used, MAC learning happens independently for each VLAN. The same physical switch port can carry traffic for more than one VLAN in some configurations, but the learning still keeps MACs separated per VLAN.

In practice, the MAC table then includes an extra column for VLAN ID. An entry might look like:

In this example, the same MAC address appears in two different VLANs, and the switch treats these as two separate reachability entries. When a frame arrives, the switch always considers both the VLAN and the MAC address when searching the table.

This separation is important because VLANs define different broadcast domains, and learning must not mix information from one broadcast domain into another.

MAC Learning and Loops

MAC learning assumes that frames from a given source MAC will be seen coming in on a consistent port in a given VLAN. If there are switching loops in the network, frames can circulate and appear on multiple ports in unexpected patterns. This causes the switch to keep updating the MAC table with different ports for the same MAC address.

From the perspective of MAC learning alone, this looks like the device is constantly moving between ports. The result is unstable forwarding, where frames may be sent out the wrong place or flooded excessively.

To manage this problem, other features such as Spanning Tree Protocol are used, which you will see in a later chapter. For now, it is enough to understand that MAC learning expects a loop free topology for stable results.

MAC Address Table Capacity

Every switch has a limit on how many MAC addresses it can remember. This is often in the thousands or tens of thousands, but the exact number depends on the hardware. If the number of active MAC addresses in the network approaches or exceeds this capacity, the switch has to evict entries sooner or fails to store new ones.

When the MAC table is full, the switch behaves more often as if destination MACs are unknown, which leads to more flooding. This can affect performance and stability in large or badly segmented networks. Proper network design and VLAN planning help keep the number of MACs per switch within safe limits.

Port Security and MAC Learning

Some switches can restrict which MAC addresses are allowed on a port. This feature is often called port security, and it builds directly on MAC learning. The switch first learns which MAC addresses appear on a port, and then can enforce rules such as allowing only the first learned address or a specific list.

The enforcement details, such as what happens when an unexpected MAC appears, belong to security topics, but the key link is that the basic learning process provides the information that security features use.

Summary

MAC learning is the core behavior that turns a switch from a simple repeater into an intelligent forwarding device. By observing the source MAC of every incoming frame, the switch builds a MAC table that maps addresses to ports on a per VLAN basis. It uses this table to send frames directly to the correct destination whenever possible, and falls back to flooding only when necessary. Aging, static entries, VLAN separation, and capacity limits all shape how this learning behaves in real networks.