The Switch MAC Address Table: Learning, Ageing and Flooding

What separates a switch from a hub is that it knows which port a frame should leave by, and that knowledge lives in a dynamically maintained MAC address table, often called the CAM table. Understand its three behaviours and you largely understand layer 2 forwarding.

Learning: building the table from source addresses

A switch builds its table with no configuration at all. For every frame received it reads the source MAC address and records that this address appeared on this port in this VLAN. Entries look like this:

Note that learning keys on the source address, not the destination. The consequence is that a switch only learns about a device when that device speaks. Something that never transmits and only listens never appears in the table.

Forwarding decisions: three cases

On receiving a frame the switch looks up the destination MAC:

Found, on a different port. Send it out that one port only. This is where a switch's efficiency comes from.

Found, on the ingress port. Drop it. Destination and source on the same port means the sender's own segment already carries it, so forwarding is unnecessary.

Not found. Flood it out every port in that VLAN except the ingress. Behaviour here is the same as a hub. The target usually replies, that reply teaches the switch where it is, and flooding stops from then on.

Broadcast and multicast frames take the flooding path too. The mapping rules are in multicast MAC addresses and the reserved addresses in broadcast and other reserved MAC addresses.

Ageing: entries do not last forever

Entries have an ageing timer, typically 300 seconds by default. The timer resets whenever that address appears as a source again. Unplug a device or leave it silent and the entry is removed, so frames addressed to it are flooded again.

A short ageing time increases flooding; a long one sends traffic to a stale port after a device moves. The default suits most networks and is not worth adjusting casually. There is one exception: on a spanning-tree topology change the switch deliberately flushes affected entries quickly, so it does not keep forwarding according to the old topology.

To inspect the table:

show mac address-table
show mac address-table count

Capacity and MAC flooding attacks

The table has a hardware capacity limit, commonly a few thousand to a few tens of thousands of entries on access switches. An attacker can send a continuous stream of frames with forged source addresses to fill it. Once full, new addresses cannot be learned and the switch degrades to flooding much of its traffic, letting the attacker sniff from any port traffic that should never have reached them. This is MAC flooding, also called CAM table overflow.

The defence is port security: cap how many MACs a port may learn and alert, drop or shut down on violation.

switchport port-security
switchport port-security maximum 3
switchport port-security violation restrict

A sensible cap on access ports is cheap hardening. A limit of one suits server ports, while office ports need headroom, because a desktop with an IP phone or virtual machines behind it presents several MACs. See MAC addresses in virtual machines and containers.

Using it to locate devices

The MAC address table is the central tool for locating a device by MAC. If the port you find is an uplink, log into the next switch down and repeat. Combined with a vendor check on the lookup page, it quickly tells you which direction to search.