TechKnowSurge
Cisco CCNA 1.13 CompTIA Network+ 2.2 Cisco CCST Networking 4.5 CompTIA Network+ 1.2
TechKnowSurge Catalog Videos MAC Address Tables
VideoNetworkFree

MAC Address Tables

Network switches build and maintain a MAC address table—also called a CAM table—to intelligently forward frames to the correct port based on destination MAC addresses. This table is dynamically updated as frames pass through the switch and ages out stale entries to keep up with changing network conditions.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Network switches use a MAC address table, sometimes called a CAM table (Content Addressable Memory), to determine which port a frame should be forwarded to based on its destination MAC address. This table is built dynamically: each time a frame arrives at the switch, the switch reads the source MAC address and the port it came in on, then records that association. Over time, the table accumulates entries for every active device reachable through the switch, enabling efficient, targeted forwarding rather than indiscriminate broadcasting. Because network environments are constantly changing—devices power off, move to new locations, or connect to different ports—switches implement an aging mechanism to keep the MAC address table accurate. If a device stops generating traffic on a given port, its entry will eventually expire and be removed from the table. This prevents stale mappings from causing frames to be sent to the wrong port after a device has moved or gone offline. When a switch receives a frame destined for a MAC address that does not yet appear in its table, it handles the uncertainty by flooding the frame out all ports except the one it arrived on. This ensures the frame reaches its destination regardless of the switch's current knowledge. Once the target device responds, its MAC address and port are recorded, and future frames can be forwarded directly without flooding.

What you'll learn

What's covered

Switch MAC Address Learning

Aligned to

Cisco CCNA
1.13 Describe switching concepts
CompTIA Network+
2.2 Given a scenario, configure switching technologies and features.
1.2 Compare and contrast networking appliances, applications, and functions.
Cisco CCST Networking
4.5 Explain basic switching concepts

Key terms

Switch
A network device that connects devices within a LAN and forwards traffic based on MAC addresses.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Data Link Layer
Layer 2 of the OSI model responsible for node-to-node data transfer and error detection on a single network segment.
MAC Address Table
A table maintained by a switch (also called the CAM table) that maps source MAC addresses to the switch ports on which those devices were learned. When a frame arrives, the switch looks up the destination MAC in this table to forward it out only the correct port rather than flooding all ports.
Content Addressable Memory
CAM
High-speed memory used in network switches to store the MAC address table, enabling near-instantaneous lookups of which port a destination MAC address is associated with. CAM tables are populated dynamically as switches learn source MAC addresses from incoming frames.
Flooding
The process a switch uses to forward a frame out all ports except the one it arrived on when the destination MAC address is not found in the MAC address table.
MAC Address Aging
The automatic removal of a MAC address table entry after a set period of inactivity, keeping the table current as devices join or leave the network.

Transcript

How a Switch Learns MAC Addresses

We know that a switch's job is to forward frames on a network to their proper location based off of the destination MAC address. But how does it know which port those different MAC addresses are on?

That switch is going to have to somehow learn which MAC addresses are associated with which ports, and it does this anytime a frame comes through that switch. For instance, if this PC here is sending out a message and it's going to this switch, then that switch is going to look in that frame. It's going to look at the destination MAC address so it knows where to send it. But it's also going to look at the source MAC address and see where the source MAC address is coming in. So if this frame is coming in through port one, it's going to record that this is coming in through port one, and then it's also going to record the source MAC address into this table.

Then it'll keep track of this. It'll keep track of the different ports that are associated with the different MAC addresses. That way, when another frame comes through there and it's destined for this machine, it will know that that is on port one and it can send it that direction.

When this machine does a reply to that machine and it comes through that switch, then it will do the same thing. It will record, okay, this server is on port 8, and then it's going to record that that is with the MAC address into that table.

The MAC Address Table

So this table that tracks this will continue to track all of the different MAC addresses and their associated ports that are on this table. This table is called the MAC address table. You'll hear the term MAC address table, or you'll also hear a CAM table as well. CAM stands for content addressable memory. These are two terms for the same thing. It's just referencing this table of MAC addresses to ports on a switch.

Aging Out Records

Our networks are very dynamic, so there are constantly machines that are being plugged in and being unplugged, and a machine could go offline. This could even be a problem if, let's say, it's plugged into one switch and then that machine moves to another location, and all the switches have not had a chance to learn the new location. Then there are some communications that can be missed and not make it to that end destination.

So what we need is some sort of mechanism that will retire these MAC addresses over a certain period of time. If a machine does not communicate on a port after a certain period of time, then it will expire that record — we call this aging, that that record will age out. So if a machine, let's say this machine right here, goes offline, and over time it doesn't renew that record, then it will remove that record and it will age out that record.

Flooding to an Unknown Destination

There are sometimes when a machine has not had a chance to communicate or send any information out. Let's say this device has not sent out a message yet and this switch does not know where that machine is at. So when a message gets sent that's destined for this machine right here, that switch does not know where that's located at. What it'll do is it will flood that message out all other ports.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →