Switching
How switches learn, forward, and filter traffic
How Switches Learn: The MAC Address Table
A switch is fundamentally a MAC-address-to-port mapping engine. It maintains a table (historically called the CAM table — Content Addressable Memory) that maps source MAC addresses to the physical port where that MAC was last seen. This table is built dynamically through observation, not configuration.
CAM Table Entry Structure
| MAC Address | Port | VLAN | Age Timer |
|---|---|---|---|
00:1A:2B:3C:4D:5E |
Gi0/1 | 10 | 120s |
AA:BB:CC:DD:EE:FF |
Gi0/24 | 10 | 45s |
00:50:56:A1:B2:C3 |
Gi0/3 | 20 | 290s |
The Learning Process
- Frame arrives on a port — The switch reads the source MAC address from the Ethernet header.
- Update the CAM table — If the source MAC is not in the table, add it with the ingress port and start an age timer (default: 300 seconds on most switches). If it already exists but on a different port, update the port (the host moved).
- Look up the destination MAC — The switch reads the destination MAC and checks the CAM table for a matching entry.
- Forward or flood — If found, forward out the specific port. If not found, flood out all ports in the same VLAN (except the source port). See the decision logic below.
Note
Age timer: Entries expire if the source MAC isn't seen again within the aging time. This prevents stale entries from accumulating. On Cisco switches, view with show mac address-table aging-time and inspect with show mac address-table dynamic.
Switch Forwarding Decision Logic
Every frame that arrives at a switch goes through the same decision tree. This is the core algorithm that makes L2 switching work.
Frame In
Read src + dst MAC
Learn Source
Add/update CAM table
Lookup Dest
Search CAM for dst MAC
Decision
Forward / Filter / Flood
Known Unicast
Destination MAC is in the CAM table.
Action: Forward out the specific port associated with that MAC.
If the destination port is the same as the source port, the frame is filtered (dropped) — the sender and receiver are on the same segment.
Unknown Unicast
Destination MAC is not in the CAM table.
Action: Flood out all ports in the same VLAN except the source port.
This is how the switch "discovers" where the destination lives — when the target replies, the switch learns its port.
Broadcast
Destination MAC is FF:FF:FF:FF:FF:FF.
Action: Flood out all ports in the same VLAN except the source port.
ARP requests, DHCP Discover, and many discovery protocols use broadcast. Every host in the VLAN processes these.
Multicast
Destination MAC starts with 01:xx:xx (I/G bit set).
Action: Flood out all ports — unless IGMP snooping is enabled, in which case the switch only forwards to ports with registered multicast listeners.
Without IGMP snooping, multicast is effectively broadcast from the switch's perspective.
Switches vs. Hubs vs. Bridges
- Layer 1 device — a multiport repeater
- Receives a signal on one port, blindly retransmits on all other ports
- No MAC learning, no intelligence
- All ports share a single collision domain
- Half-duplex only — CSMA/CD required
- 10 ports = 10 devices sharing 10 Mbps
- Layer 2 device — examines Ethernet headers
- Learns MACs, forwards intelligently to specific ports
- Each port is its own collision domain
- Full-duplex — simultaneous send/receive
- 10 ports = 10 devices each with dedicated bandwidth
- Microsecond forwarding latency via ASIC hardware
Where Do Bridges Fit?
A bridge was the predecessor to the switch — a 2-port device that learned MACs and filtered/forwarded between two network segments. A switch is essentially a multiport bridge. The terms are sometimes used interchangeably in protocol specifications (STP refers to "bridges," but it runs on switches). Bridges are functionally extinct as standalone hardware, but the concept lives on in software bridges (brctl, ip link add type bridge) used heavily in Linux networking, Docker, and KVM/libvirt.
Store-and-Forward vs. Cut-Through Switching
- Receives the entire frame before forwarding
- Validates the FCS (CRC check) — drops corrupted frames
- Higher latency (must buffer the full frame)
- Can perform MTU enforcement and error checking
- Used on most enterprise and access-layer switches
- Required for frames crossing different speed ports (e.g., 1G to 10G)
- Reads only the first 14 bytes (dest MAC + src MAC + EtherType)
- Starts forwarding immediately — before the frame is fully received
- No FCS validation — corrupted frames are forwarded
- Lowest latency (~2-5 microseconds)
- Used in data center / high-frequency-trading switches
- Fragment-free variant: reads first 64 bytes (filters runts from collisions)
Note
In practice: Most modern data center switches (Arista, Cisco Nexus) support both modes and can dynamically switch from cut-through to store-and-forward when error rates rise above a threshold. For latency-sensitive workloads (HFT, real-time telemetry), cut-through is preferred. For reliability-focused environments, store-and-forward prevents error propagation.
STP — Spanning Tree Protocol (IEEE 802.1D)
Why L2 Loops Are Fatal
Redundant links between switches are essential for availability, but they create Layer 2 loops. Unlike IP (which has TTL to kill looping packets), Ethernet frames have no TTL. A frame in a loop circulates forever, consuming bandwidth exponentially.
Broadcast Storms
A broadcast frame is flooded by every switch. In a loop, it comes back, gets flooded again, and multiplies. Within seconds, the network is saturated at 100% utilization on every link.
MAC Table Instability
The same source MAC appears on different ports as the looped frame arrives from multiple directions. The CAM table flaps constantly, breaking even unicast forwarding.
Duplicate Frames
Unicast frames reach the destination multiple times via different loop paths. TCP handles this (it deduplicates), but applications relying on UDP or raw L2 may process duplicates incorrectly.
Warning
This is not theoretical. A single cable creating an L2 loop can take down an entire VLAN within seconds. Broadcast storms are one of the most common causes of total network outages in enterprise environments. If you've seen a Kubernetes cluster lose all Pod-to-Pod connectivity simultaneously, an L2 loop is a prime suspect.
How STP Works
STP eliminates loops by logically disabling redundant links while keeping them physically connected for failover. It builds a loop-free tree topology from the physical mesh.
- Root Bridge Election — All switches exchange BPDUs (Bridge Protocol Data Units). The switch with the lowest Bridge ID (priority + MAC address) becomes the root bridge. Default priority is 32768; lower wins. In production, you explicitly set priority to control which switch becomes root (e.g., set your core switch to priority 0 or 4096).
- Root Port Selection — Every non-root switch selects one root port — the port with the lowest-cost path to the root bridge. Path cost is based on link speed (10G = 2, 1G = 4, 100M = 19, 10M = 100 using short path cost).
- Designated Port Selection — On each network segment (link between switches), one port is elected as the designated port — the port that forwards traffic toward the root bridge on that segment. The switch with the lowest root path cost wins.
- Block Remaining Ports — Any port that is neither a root port nor a designated port is put into blocking state. It does not forward data frames but continues to listen for BPDUs in case the topology changes.
STP Port Roles
Root Port
Best path to root bridge. One per non-root switch. Forwards traffic.
Designated Port
Best port on each segment toward root. One per link. Forwards traffic.
Blocked Port
Redundant path — logically disabled. Receives BPDUs only. Activates if the active path fails.
STP Port States
| State | Receives BPDUs | Learns MACs | Forwards Data | Duration |
|---|---|---|---|---|
| Blocking | Yes | No | No | 20s (max age) |
| Listening | Yes | No | No | 15s (forward delay) |
| Learning | Yes | Yes | No | 15s (forward delay) |
| Forwarding | Yes | Yes | Yes | Indefinite |
Warning
Classic STP convergence time: ~50 seconds. That's 20s (max age — time before a switch suspects a root bridge failure) + 15s (listening) + 15s (learning). During this window, traffic on affected paths is black-holed. This is unacceptable for modern workloads, which is why RSTP exists.
STP Topology Example
Reading the Topology
- Switch A is the root bridge (lowest priority: 4096). All its ports are designated (forwarding).
- Switch B connects to A via Gi0/1 (root port, forwarding). B's port toward C is designated (forwarding).
- Switch C connects to B via Gi0/1 (root port, forwarding). C also has a redundant link back to A — that port on C is blocked because A's port is the designated port for that segment.
- If the B-C link fails, C's blocked port toward A transitions to forwarding (after convergence), restoring connectivity.
RSTP — Rapid Spanning Tree (IEEE 802.1w)
RSTP replaced classic STP as the default on virtually all modern switches. It solves the convergence speed problem while maintaining backward compatibility.
- Convergence: 30–50 seconds
- 5 port states (blocking, listening, learning, forwarding, disabled)
- Only root bridge generates BPDUs — other switches relay them
- Relies on timers for failover detection
- Passive topology changes — waits for max age expiry
- Convergence: 1–6 seconds (often sub-second)
- 3 port states (discarding, learning, forwarding)
- All switches generate BPDUs — faster failure detection
- Proposal/agreement handshake for rapid transition
- New role: alternate port (pre-computed backup root port) and backup port
RSTP Port Roles (vs STP)
| RSTP Role | STP Equivalent | Purpose |
|---|---|---|
| Root | Root | Best path to root — same as STP |
| Designated | Designated | Forwarding port on each segment — same as STP |
| Alternate | Blocked | Backup root port — instantly takes over if the root port fails |
| Backup | (no equivalent) | Backup for a designated port on the same switch (rare — only with shared media) |
Tip
Operational note: Always enable RSTP (or MSTP for multi-VLAN environments). Configure root bridge priority explicitly — don't leave it to chance. Enable BPDU Guard on access ports (ports connected to hosts) to prevent accidental loops from rogue switches. On Cisco: spanning-tree portfast bpduguard default. This will err-disable a port instantly if it receives a BPDU, which is exactly what you want on a server or workstation port.
