Layer 2 Switching — How Switches Forward Frames and Learn MAC Addresses

Layer 2 switching is forwarding Ethernet frames based on MAC addresses, at the data link layer of the OSI model. The switch never opens the IP header. It reads the destination MAC, consults a table, and sends the frame out of one port, in hardware, in microseconds.

Everything a Layer 2 switch does reduces to three functions: address learning, forwarding and filtering, and loop avoidance. Understanding those three explains nearly every switching behaviour and most switching interview questions.

1. Address Learning, Building the CAM Table

A switch starts with an empty MAC address table (also called the CAM table, after the content-addressable memory it lives in). It fills the table by reading the source MAC of every frame that arrives:

1. A frame arrives on port Gi0/3 with source MAC 0011.2233.4455.
2. The switch records: 0011.2233.4455 → Gi0/3, VLAN 10.
3. An ageing timer starts, 300 seconds by default on Cisco. If no further frame is seen from that MAC, the entry is removed.

Entries can also be added statically:

Switch(config)# mac address-table static 0011.2233.4455 vlan 10 interface Gi0/3

Static entries never age out and are used to pin a critical device to a known port. Verify either kind with:

Switch# show mac address-table
Switch# show mac address-table dynamic vlan 10

2. Forwarding and Filtering

Once a frame’s destination MAC is read, the switch does exactly one of three things:

Broadcast frames (ffff.ffff.ffff) and unknown multicast are always flooded within the VLAN. This is why a switch does not break up a broadcast domain, only a router or a VLAN boundary does that. See collision and broadcast domains for the full distinction.

3. Loop Avoidance

Layer 2 frames have no TTL field. A looped frame therefore circulates forever, and because broadcasts are flooded, a single physical loop produces a broadcast storm that saturates every link within seconds, plus MAC table instability as the switch keeps relearning the same address on different ports.

Spanning Tree Protocol solves this by electing a root bridge and blocking redundant paths, leaving exactly one active path between any two points, and reactivating a blocked link when the primary fails.

Switching Methods, Store-and-Forward vs Cut-Through

How much of a frame a switch reads before it starts forwarding is a latency-versus-integrity trade-off:

Fragment-free is the compromise: 64 bytes is the minimum valid Ethernet frame size, so any frame shorter than that is a collision fragment and can be discarded, while the switch still avoids buffering the whole frame.

Modern enterprise switches use store-and-forward almost universally, it is required for QoS inspection, for changing speeds between ports, and for not propagating errors. Cut-through survives in ultra-low-latency environments such as high-frequency trading and some data centre fabrics, where microseconds matter more than filtering the occasional bad frame.

Layer 2 vs Layer 3 vs Multilayer Switching

A Layer 3 switch is not a router replacement in every sense, it routes very fast between local VLANs but usually lacks WAN interfaces and the full routing feature set. What it does have is CEF, which pre-builds a forwarding table (FIB) and an adjacency table so the hardware can forward without punting packets to the CPU. That replaced the older process switching (a routing lookup per packet, done in software) and fast switching (first packet in software, subsequent packets from a cache).

What Happens to a Frame, End to End

1. PC A sends a frame to PC B. Its destination MAC is B’s, learned earlier via ARP.
2. The frame arrives on switch port Gi0/1. The switch records A’s MAC against Gi0/1.
3. The switch looks up B’s MAC. If known, it forwards out that port only. If unknown, it floods within the VLAN.
4. B replies. That reply teaches the switch which port B is on, so subsequent frames in both directions are forwarded, not flooded.
5. Each port is its own collision domain running full duplex, so A and B can transmit simultaneously without contention.

Frequently Asked Questions

What is the difference between the CAM table and the MAC address table?

They are the same thing. “CAM table” refers to the content-addressable memory the table is stored in, which allows a lookup by value in a single operation. Cisco documentation uses “MAC address table”; engineers say both.

Does a switch break up broadcast domains?

No. A Layer 2 switch floods broadcasts to every port in the VLAN. Breaking up broadcast domains requires VLANs or a router.

What happens when the MAC address table is full?

The switch can no longer learn new addresses and floods traffic for unknown destinations out of every port. Attackers exploit this deliberately, MAC flooding forces the switch to behave like a hub so traffic can be captured. Port security is the defence.

Why is unknown unicast flooded rather than dropped?

Because the switch has no way to know the destination does not exist. Flooding guarantees delivery if the host is reachable at all, and the reply immediately teaches the switch the correct port so it only happens once.

Is cut-through switching still used?

Rarely, and only where latency is critical, high-frequency trading and certain data centre fabrics. Store-and-forward is the default everywhere else because it filters corrupt frames and supports QoS and speed conversion.

How long does a MAC address stay in the table?

300 seconds by default on Cisco switches, refreshed each time a frame is seen from that address. Static entries never expire.