MAC Address Table Simulator

About this interactive

Almost everyone can recite that a switch floods an unknown destination, forwards a known one, and learns from source addresses. Far fewer can say what the table holds three frames into a conversation, whether a broadcast teaches the switch anything, what happens when two hosts sit behind one port, or why an entry that has just aged out leaves no hint behind. Those are the details a troubleshooting question turns on. This activity feeds six frames through one switch and stops ten times to make you commit to an outcome before it shows you the real one: the empty-table flood, the reply that becomes a forward, the broadcast that is flooded without a lookup but learned from anyway, the frame filtered because its destination sits on the port it arrived on, the unicast flooded again once aging removed the entry, and the host that moves to a new port and corrects the table with its very first frame.

What you'll learn

Decide whether a switch floods, forwards or filters a given frame, from the destination MAC address and the current state of the MAC address table
Predict the contents of a switch MAC address table after each frame arrives, distinguishing what a frame proves about its source from what it only claims about its destination
Explain how aging, a port move and two hosts behind one port each change the table, and what each change does to the next forwarding decision

Aligned to

Cisco CCNA

1.13 Describe switching concepts

CompTIA Network+

2.2 Given a scenario, configure switching technologies and features.

1.2 Compare and contrast networking appliances, applications, and functions.

Cisco CCST Networking

4.5 Explain basic switching concepts

Key terms

MAC Address Table: A table maintained by a switch (also called the CAM table) that maps source MAC addresses to the switch ports on which those devices were learned. When a frame arrives, the switch looks up the destination MAC in this table to forward it out only the correct port rather than flooding all ports.
Flooding: The process a switch uses to forward a frame out all ports except the one it arrived on when the destination MAC address is not found in the MAC address table.
MAC Address Aging: The automatic removal of a MAC address table entry after a set period of inactivity, keeping the table current as devices join or leave the network.
Content Addressable Memory: High-speed memory used in network switches to store the MAC address table, enabling near-instantaneous lookups of which port a destination MAC address is associated with. CAM tables are populated dynamically as switches learn source MAC addresses from incoming frames.
MAC Address: A 48-bit hardware address assigned to a network interface and written as six hexadecimal octets, such as 00:1A:2B:3C:4D:5E. It identifies a device uniquely on a local network segment, and switches forward frames by looking it up in their MAC address table.
Switch: A network device that connects devices within a LAN and forwards traffic based on MAC addresses.
Broadcast: A transmission type in which one device sends a single packet that is delivered to every other device on the local network segment simultaneously. Broadcast traffic is contained within a broadcast domain and does not cross router boundaries.
Unicast: A transmission type in which a packet is sent from one source directly to one specific destination device, identified by its unique IP or MAC address. Unicast is the standard delivery method for most internet traffic such as web browsing and file downloads.
Ethernet Frame: The Layer 2 data unit used on Ethernet networks, containing a preamble, source and destination MAC addresses, an EtherType field identifying the Layer 3 protocol, a payload (typically an IP packet), and a 4-byte FCS for error detection. Switches use the MAC addresses in Ethernet frames to make forwarding decisions.
Hub: A basic Layer 1 network device that receives a signal on one port and repeats it out every other port simultaneously, creating a single shared collision domain among all connected devices. Hubs have been replaced by switches in modern networks because they waste bandwidth and cause collisions.

Topics

Interactive Predict

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →