Quick Summary
- Switches operate at Layer 2 (Data Link) and forward frames based on MAC addresses
- They build a MAC address table by learning which MAC is connected to which port
- Unknown destination MACs cause the switch to flood the frame out all ports except the source
What Is a Network Switch?
A network switch is a device that connects multiple devices on a local area network (LAN) and forwards data between them. Unlike a hub, which blindly copies incoming data to every port, a switch is intelligent -- it reads the destination MAC address in each Ethernet frame and sends the frame only to the port where the destination device is connected. This makes switches far more efficient than hubs and is the reason hubs have been almost entirely replaced in modern networks.
Switches operate at Layer 2 of the OSI model, also known as the Data Link layer. They do not understand IP addresses -- that is the job of routers at Layer 3. Instead, switches deal exclusively with MAC addresses (Media Access Control addresses), which are unique 48-bit hardware identifiers burned into every network interface card. A typical MAC address looks like AA:BB:CC:11:22:33.
When a switch is first powered on, its MAC address table (also called a CAM table -- Content Addressable Memory) is empty. The switch has no idea which device is connected to which port. As frames arrive, the switch learns by examining the source MAC address of each frame and recording which port it came from. Over time, the table fills up and the switch can forward frames directly to the correct port without wasting bandwidth by sending data everywhere.
Interactive: Switch Frame Forwarding Simulator
Choose a scenario and click "Send Frame" to watch the switch process an Ethernet frame. Toggle between known and unknown MAC addresses to see the difference between forwarding and flooding.
Switch Simulator
MAC Address Table
| MAC Address | Port | Age |
|---|---|---|
| Table empty -- send a frame to start learning | ||
The Three Switch Actions
A switch performs exactly three actions with every frame it receives. Understanding these three actions is the key to understanding how switches work:
Learn
When a frame arrives, the switch reads the source MAC address and records it in the MAC address table along with the port number the frame arrived on. If the MAC is already in the table, the switch refreshes its aging timer. This is how the switch builds its knowledge of the network -- entirely by observing incoming traffic. No manual configuration is needed. The learning process is automatic and continuous.
Forward
After learning the source MAC, the switch looks at the destination MAC address. If that MAC is already in the table, the switch knows exactly which port leads to the destination device. It forwards the frame only to that specific port. This is called unicast forwarding -- the frame goes to one port and one port only, keeping all other ports free for their own traffic.
Flood
If the destination MAC is not in the table, the switch does not know which port the destination device is connected to. In this case, the switch sends a copy of the frame out every port except the one it arrived on. This is called flooding. It is wasteful, but it guarantees the frame will reach the right device. When the destination device replies, the switch will learn its MAC and port, and future frames will be forwarded directly.
MAC Address Table Aging
Entries in the MAC address table do not stay forever. Each entry has an aging timer, typically set to 300 seconds (5 minutes) by default. Every time the switch sees a frame from a MAC address, the timer for that entry resets. If the switch does not see any traffic from a particular MAC within the aging period, the entry is removed from the table. This keeps the table current and prevents stale entries from consuming memory.
Aging is important because devices can be unplugged and moved to different ports. Without aging, the switch would keep sending frames to the old port where the device used to be. With aging, the old entry expires, and when the device sends traffic from its new port, the switch learns the updated location automatically. This self-healing behavior is one of the reasons switches are so reliable and require minimal maintenance.
Switches vs. Hubs
Before switches became affordable in the late 1990s, most LANs used hubs. A hub is a simple repeater: when a frame arrives on any port, the hub copies the electrical signal to every other port. This means every device on a hub sees every frame, creating a single collision domain. If two devices transmit simultaneously, their signals collide and both frames are corrupted. Devices must then wait and retry, wasting bandwidth.
A switch eliminates collisions by creating a separate collision domain for each port. When PC-A sends a frame to PC-B, only those two ports are involved -- PC-C and PC-D can communicate simultaneously without interference. This dramatically increases effective bandwidth. A 24-port gigabit switch can theoretically support 12 simultaneous full-duplex conversations at 1 Gbps each, totaling 24 Gbps of aggregate throughput. A hub with the same number of ports would share a single 1 Gbps link among all devices.
Broadcast Frames
Frames with destination MAC FF:FF:FF:FF:FF:FF are broadcast frames. Switches always flood broadcasts to all ports. ARP requests and DHCP discovery packets are common examples of broadcast traffic.
VLAN Support
Managed switches can assign ports to different VLANs, creating separate broadcast domains. Frames in VLAN 10 never reach ports in VLAN 20, even on the same physical switch. This improves security and reduces unnecessary traffic.
Port Security
Many switches support port security features that limit the number of MAC addresses allowed on a port. If an unauthorized device plugs in, the switch can shut down the port or send an alert.
Common Switch Misconceptions
"Switches Route Traffic"
Standard switches do not route. They forward frames based on MAC addresses (Layer 2), not IP addresses (Layer 3). Layer 3 switches exist but they are essentially routers with switch hardware built in.
"More Ports = Slower"
Unlike hubs, adding more ports to a switch does not reduce per-port bandwidth. Each port operates independently with its own dedicated bandwidth. A 48-port switch gives each device full line-rate speed.
"Switches Never Flood"
Even a well-configured switch floods frames when it encounters unknown destination MACs or broadcast/multicast frames. Flooding is normal behavior, not an error. Excessive flooding may indicate a MAC table overflow attack.
Frequently asked questions about network switches
What does a network switch do?
A switch forwards Ethernet frames between devices on the same local network based on MAC addresses. Unlike a hub, it learns which device lives on which port and only sends each frame to the port that needs it, dramatically reducing collisions and unnecessary traffic.
How does a switch learn MAC addresses?
When a switch sees a frame come in on a port, it records the source MAC and the ingress port in its MAC address table (also called the CAM table). The next time it sees a frame destined for that MAC, it knows exactly which port to send it out of.
What is flooding?
If a switch receives a frame for a destination MAC it has not yet learned, it floods the frame out every port except the one it came in on. The actual destination replies, the switch learns the MAC, and future frames are forwarded directly. Broadcast and unknown unicast frames are also flooded.
What is the difference between a switch and a router?
A switch operates at Layer 2 (Ethernet) and forwards based on MAC addresses within a single broadcast domain. A router operates at Layer 3 (IP) and forwards between different networks, making routing decisions based on IP addresses and rewriting the Ethernet header on each hop.
Why do MAC table entries expire?
MAC table entries have an aging timer (typically 300 seconds). If the switch does not see traffic from a MAC for that long, it removes the entry. This lets the table adapt when devices move between ports, get unplugged, or are replaced.
Try the switch lab
You just learned how switches learn MAC addresses and forward frames port-to-port. Now attach hosts to a switch, trace traffic between them, and read the MAC addresses on each frame in the Packet Inspector and the ARP table with arp. Press Go Live and the switch becomes a real Linux bridge carrying your pings.