How Switches Work

Each network card has a unique identifier called a Media Access Control (MAC) address. This address is used in LANs for communication between devices on the same network segment. Devices that want to communicate need to know each other MAC addresses before sending out packets.

Switches also use MAC addresses to make accurate forwarding or filtering decision. When a switch receives a frame, it associates the media access control (MAC) address of the sending device with the port on which it was received. The table that stores such associations is called a MAC address table. This table is stored in the volatile memory, so associations are erased after the switch is rebooted.

Switches usually perform these three functions in a LAN:

  • address learning – switches learn MAC addresses by examining the source MAC address of each received frame.
  • forward/filter decisions – switches decide whether to forward or filter a frame, based on the destination MAC address.
  • loop avoidance – switches use Spanning Tree Protocol (STP) to prevent network loops while still permitting redundancy.

To better how a network switch works, take a look at the following example:

How a switch works

Let’s say that host A wants to communicate with host B for the first time. Host A knows the IP address of host B, but since this is the first time the two hosts communicate, the hardware (MAC) addresses are not known. Host A uses the ARP process to find out the MAC address of host B. The switch forwards the ARP request out all ports except the port the host A is connected to. Host B receives the ARP request and responds with its MAC address. Host B also learns the MAC address of host A (because host A sent its MAC address in the ARP request). Host C receives the ARP request, but doesn’t respond since the IP address listed in the request is not its own.

As mentioned above, a switch learns which MAC addresses are associated with which port by examining the source MAC address of each received frame. Because host B responded with the ARP reply that included its MAC address, the switch knows the MAC address of host B and stores that address in its MAC address table. For host A, the switch knows its MAC address because of the ARP request that included it.

Now, when host A sends a packet to host B, the switch looks up in its MAC address table and forwards the frame only out the Fa0/2 port – the port on which host B is connected to. Other hosts on the network will not be involved in the communication:

How switch forwards unicast frames

By default, MAC addresses stay in the switch’s MAC address table for 5 minutes. So if host A and host B decide to communicate inside the next 5 minutes, a new ARP process will not be necessary.


You can display the MAC address table of the switch by using the show mac-address-table command:

Switch#show mac-address-table
          Mac Address Table

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----

   1    0003.e489.513e    DYNAMIC     Fa0/2
   1    00e0.8f13.6970    DYNAMIC     Fa0/1

The output is pretty much self-explanatory: all ports belong to VLAN 1 and MAC addresses associated with specific ports are listed. DYNAMIC means that the address were learned dynamically by using the source MAC address of the received frames.

Download our Free CCNA Study Guide PDF for complete notes on all the CCNA 200-301 exam topics in one book.

We recommend the Cisco CCNA Gold Bootcamp as your main CCNA training course. It’s the highest rated Cisco course online with an average rating of 4.8 from over 30,000 public reviews and is the gold standard in CCNA training: