Flood-then-learn behavior across a 4-port switch — watch flooding disappear as the table fills in
This simulator animates how an Ethernet switch builds its MAC address table through flood-and-learn behavior: the very first frame to any destination is flooded out every port because the switch does not yet know where that MAC lives, but each frame also teaches the switch the sender's location, so traffic quickly converges to efficient, single-port unicast forwarding.
A Layer 2 switch builds its forwarding (MAC address) table dynamically by inspecting the source MAC address of every frame it receives and recording which port that address arrived on. When a frame arrives whose destination MAC is not yet in the table (unknown unicast), the switch has no choice but to flood it out every port except the one it arrived on — exactly like a hub would. Once the destination host eventually transmits a frame of its own, the switch learns its location too, and every future frame addressed to it is forwarded out that single port only.
Three distinct switch behaviors are easy to confuse. Flooding happens when the destination MAC is unknown — a temporary, self-correcting condition that disappears once the table is complete. Forwarding is the steady-state behavior once a MAC is known — a clean, single-port unicast send. Broadcasting (destination FF:FF:FF:FF:FF:FF, e.g., ARP requests) is always flooded regardless of table state, because a broadcast is, by definition, addressed to everyone on the segment — this is the traffic that VLANs exist to contain.
MAC table entries are not permanent. Cisco switches age out an entry after 300 seconds (5 minutes) of inactivity by default, after which the next frame to that MAC floods again until it is relearned. If a switch observes the same source MAC on two different ports in rapid succession ("MAC flapping"), that is a red flag for a Layer 2 loop, a duplicate/spoofed MAC, or an unauthorized device — most enterprise switches log a warning or trigger port security when this happens.
The switch has no prior knowledge of which port that destination MAC address is reachable through — it has never seen a frame with that address as the source. Flooding is the fallback so the frame still reaches its destination even without a table entry; the reply from that destination then teaches the switch its location.
Momentary flood-then-learn is normal and not a security issue by itself. However, an attacker can deliberately overflow the MAC table with forged source addresses (a "MAC flooding" or CAM table overflow attack) to force the switch into flooding all traffic, which can then be sniffed. Port security with a maximum MAC count per port mitigates this.
No — a VLAN-aware switch maintains a logically separate MAC table per VLAN (or a single table keyed by VLAN + MAC). The same physical MAC address can appear associated with different ports if it exists in different VLANs via different interfaces, though this is unusual outside of trunk/router scenarios.
The MAC address table (CAM table) is a Layer 2 switch construct mapping MAC addresses to physical switch ports. The ARP table (or ARP cache) is a Layer 3 host/router construct mapping IP addresses to MAC addresses. They serve different layers but work together: ARP resolves the MAC address, and the switch's MAC table then decides which port to forward the resulting frame out of.
Try our Enterprise IT Networks Studio
More calculators, simulators, and guides for this discipline.