4.4Basic switching concepts

A switch does not know from the start where its connected devices are. Watching traffic, it gradually learns "which MAC-address device is beyond which port" and uses that table to deliver frames only to the correct port. This learning mechanism is the MAC address table. This section covers the table's learning, flooding when the destination is unknown, aging that removes stale entries (default 300 seconds), MAC address filtering for permit control, and the VLAN that logically divides one switch—learned while glancing at show mac address-table output as the basics of "how a switch learns and delivers to a destination."

4.4.1MAC address table: learning and behavior

• Learning: on receiving a frame, a switch records the mapping of its source MAC address to the receiving port number in the MAC address table. Repeating this builds a map of "which MAC is beyond which port," so later frames to that MAC go to only the right port (reducing needless traffic).
• Flooding: when the destination MAC is not yet in the table (unlearned), or the frame is a broadcast, the switch sends it out all ports except the one it arrived on. If the peer replies, its source MAC gets learned, and flooding is no longer needed thereafter.
• Aging: if there is no traffic from a MAC for a set time, its stale entry is removed. The default aging time is 300 seconds (5 minutes). This keeps the table current as devices move or power off, and show mac address-table shows the current learning state.

4.4.2MAC filtering and VLAN

• MAC address filtering permits or denies communication for specific MAC addresses—for example, allowing only devices on an allow-list. But because MACs can be spoofed, it is not strong security on its own (understand it as a supplementary measure).
• A VLAN (Virtual LAN) logically divides one physical switch into multiple networks. Different VLANs are separate broadcast domains, so a broadcast in one VLAN does not reach another. It can separate communication scope per department and curb broadcast spread. Communication between VLANs requires routing (L3).

When a freshly connected PC sends its first traffic, the switch does not yet know its MAC. So this first frame, whose destination MAC is not in the table, is flooded out all ports except the arrival one. When the destination replies, the switch learns the reply frame's source MAC and receive port into the MAC address table, and thereafter sends frames for that MAC to only the right port—the basic behavior of broadcasting at first, then learning to cut waste. A field hint here is the show mac address-table output. If a device is unreachable and its MAC is not listed in this table, you can guess that no traffic has ever arrived from it (perhaps a physical/link problem); and if behavior is odd right after moving a device to a different port because stale info lingers, recall that the default 300-second aging will eventually drop the old entry. Also, if "devices are on the same switch yet a Department A terminal cannot see a Department B terminal at all," that may not be a fault but a design where a VLAN divides the broadcast domain. Different VLANs are treated as different networks, and mutual communication needs L3 routing. On security, MAC address filtering that permits only specific MACs is a handy entry control, but because MACs can be spoofed, the correct understanding is to not rely on it alone. At the introductory stage, grasping these not as isolated facts but as one story—"learn -> flood the unknown -> tidy the old by aging" and "divide broadcast scope with VLANs"—makes switch behavior click into place.

4.4.3Section summary

• A switch learns source MAC + receive port into the MAC address table and floods unknown/broadcast frames out all ports except the arrival one
• Idle entries are removed by aging (default 300 s); show mac address-table shows the learning state
• A VLAN divides the L2 broadcast domain (inter-VLAN needs L3); MAC filtering is supplementary (can be spoofed)