Every frame a switch forwards is a lookup in one table: the MAC address table (historically the CAM table). Understanding how entries get into that table, how long they stay, and what happens when a destination isn't in it explains half of Layer 2 behavior - flooding, unicast delivery, even why some attacks work. This article walks the whole lifecycle with real output from a Cisco IOS XE switch in our Network Fundamentals lab: two Linux hosts (H1 and H2) and a router hanging off a switch in VLAN 10.
The three rules of switching
A switch applies three rules to every frame, in order:
- Learn: read the source MAC of the incoming frame and record it against the ingress port and VLAN.
- Forward: look up the destination MAC. If there's an entry, send the frame out that one port (filtering it from all others).
- Flood: if there's no entry (unknown unicast), or the destination is broadcast/unknown multicast, send the frame out every port in the VLAN except the one it arrived on.
That's it. A $100,000 chassis and a lab switch both do exactly this; everything else is optimization.
Watching the table learn
After H1 (10.0.10.11) pinged H2 (10.0.10.12) and the gateway, here's the table:
SW1# show mac address-table dynamic
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
10 5254.0065.04be DYNAMIC Et0/2
10 5254.007a.17d9 DYNAMIC Et0/1
10 aabb.cc00.1210 DYNAMIC Et0/0
10 ba3c.5334.f483 DYNAMIC Et0/1
10 eab6.3ad2.6a78 DYNAMIC Et0/2
Total Mac Addresses for this criterion: 5Read it like the switch does: "if a frame is destined to 5254.007a.17d9 in VLAN 10, send it out Ethernet0/1." Note there are five MACs on three ports - Et0/1 and Et0/2 each show two addresses because the Linux hosts also emitted frames from a second (container-side) interface MAC. Multiple MACs per port is completely normal: that's what you see behind IP phones, hypervisors, or a downstream switch.
Counting and capacity
SW1# show mac address-table count
Mac Entries for Vlan 10:
---------------------------
Dynamic Address Count : 5
Static Address Count : 0
Total Mac Addresses : 5Table capacity is finite (thousands to hundreds of thousands of entries depending on platform). That finiteness is why MAC flooding attacks exist: fill the table with garbage source MACs and the switch degrades to flooding everything, turning it into a hub an attacker can sniff. That's the problem port security solves.
Aging: why entries disappear
SW1# show mac address-table aging-time
Global Aging Time: 300Dynamic entries age out after 300 seconds of silence from that source MAC by default. Every new frame from the MAC resets its timer. Aging matters for a practical reason: when a host moves ports (laptop roams, VM migrates, cable gets repatched), the stale entry either ages out or is overwritten the moment the host transmits from its new port. The learn rule always wins - the table tracks the latest port a source MAC appeared on.
Flush and relearn: the demo
Clear the table and it's empty for a moment; the very next traffic rebuilds it:
SW1# clear mac address-table dynamic
SW1# show mac address-table dynamic
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
! H1 pings H2 - two packets is all it takes:
SW1# show mac address-table dynamic
Vlan Mac Address Type Ports
---- ----------- -------- -----
10 5254.0065.04be DYNAMIC Et0/2
10 5254.007a.17d9 DYNAMIC Et0/1
10 aabb.cc00.1210 DYNAMIC Et0/0
Total Mac Addresses for this criterion: 3Think about what happened to the first frame after the clear: H1's ICMP echo arrived with an unknown destination (H2's MAC wasn't in the table), so the switch flooded it out Et0/0 and Et0/2. H2 replied; that reply's source MAC populated Et0/2, and from the second frame on, traffic between H1 and H2 was filtered unicast - the router port never saw it again. Flooding is self-limiting: it lasts exactly one round-trip per destination.
Where ARP fits (and where it doesn't)
Students constantly conflate the MAC table with ARP. Keep them straight: ARP is a host function mapping IP addresses to MAC addresses; the MAC table is a switch function mapping MAC addresses to ports. The switch doesn't need ARP to switch frames, and your PC doesn't have a MAC-to-port table. They cooperate - an ARP broadcast is flooded by rule 3, and conveniently teaches the switch the sender's MAC by rule 1 - but they are different tables on different devices answering different questions.
Troubleshooting with the MAC table
- "Is the host even talking?" No dynamic entry for its MAC = the switch has heard nothing in 5 minutes. Check the cable, the NIC, the VLAN.
- "Which port is this device on?"
show mac address-table address <mac>- the fastest way to physically locate anything in a building. - "Why is this port showing hundreds of MACs?" Downstream unmanaged switch, hypervisor - or a MAC flooding attack in progress.
FAQ
What is the difference between the CAM table and the MAC address table?
Same thing, two names. CAM (Content Addressable Memory) is the hardware that stores the table on real switches - memory you query by content (the MAC) and get back a port in one operation. Cisco documentation and commands say "MAC address table"; engineers say CAM. Use either.
Why does one switch port show multiple MAC addresses?
Anything that puts multiple sources behind one port: a downstream switch, a hypervisor full of VMs, an IP phone with a PC daisy-chained, or containers with their own MACs (exactly what our lab hosts showed). It's normal - unless a port that should hold one printer suddenly shows fifty MACs, which smells like a loop or an attack.
What happens when the MAC address table is full?
New source MACs can't be learned, so frames destined to them are flooded in their VLAN - the switch behaves like a hub for those hosts. MAC flooding attacks (macof) exploit this deliberately to enable sniffing, which is why port security caps MACs per port.
How do I find which switch port a device is connected to?
show mac address-table address aaaa.bbbb.cccc on the switch. If the port it returns is an uplink to another switch, hop there and repeat - two or three hops walks you to the exact access port anywhere in a campus. Get the MAC itself from the device's ARP entry on its gateway (show ip arp | include x.x.x.x).
Do switches use ARP to build the MAC table?
No. The switch learns passively from the source MAC of every frame - any frame, not just ARP. ARP is how hosts map IPs to MACs. An ARP broadcast happens to teach every switch in the VLAN the sender's location as a side effect, but the switch never sends or interprets ARP to switch frames.
Key takeaways
- Learn on source, forward on destination, flood on unknown - in that order, every frame.
- Dynamic entries age out after 300 seconds; any frame from the source resets the timer.
- Unknown-unicast flooding is normal and brief; the first reply converts it to filtered unicast.
- ARP maps IP to MAC on hosts; the MAC table maps MAC to port on switches. Different tables, different devices.
Go deeper: Lab na-01 - Switching Fundamentals and the CAM Table gives you this exact topology to break and rebuild, and the VLAN cluster covers what happens when you segment the table per VLAN. Start from the Network Fundamentals guide.
