A switch learns from the source and forwards based on the destination
That one sentence explains most Ethernet switching questions. When a frame arrives, the switch can learn where the source MAC came from. It then examines the destination MAC to decide whether to forward to one port, flood within the VLAN, or avoid sending the frame back out the ingress port.
Use a learned-table example before generalizing a switch behavior. The AP Networking Switching, VLANs, and Ethernet Practice Test includes known unicast, unknown unicast, ingress filtering, aged entries, and identical MAC values in different VLANs, each with an explanation of the relevant lookup.
Frame enters an interface in a VLAN context.
Associate source MAC with ingress port/VLAN.
Search for destination MAC in that VLAN's forwarding context.
Known unicast goes toward the learned destination port.
Unknown unicast/broadcast is replicated within the VLAN, except ingress.
Separate the fields that identify sender and intended Layer 2 receiver
If this frame enters port 3, the switch can learn that source MAC A is reachable through port 3. It then searches for destination MAC B. These are two distinct operations, and mixing them up is one of the easiest ways to miss a switching question.
The MAC table is built from observed source addresses
The switch did not need a management server to tell it where A lives. A's own transmitted frame supplied the evidence. If A later legitimately moves and sends from another port, dynamic learning can update the location.
When the destination is known, forwarding becomes targeted
The switch does not need to send this frame to C on Gi0/9. Known-unicast forwarding is selective, which is one reason switched Ethernet scales better than a shared medium where every station sees every transmission.
An unknown destination causes temporary flooding—not random guessing
If B is not yet in the MAC table, the switch cannot select B's single port. It replicates the frame to eligible ports in the same VLAN except the ingress port. If B is present, B receives the frame and may respond. B's reply gives the switch something it can learn: B as a source.
Broadcast flooding is intentional and scoped to the broadcast domain
An Ethernet broadcast destination such as ff:ff:ff:ff:ff:ff is meant for all members of that Layer 2 broadcast domain. A common example is an ARP request asking which local device owns a particular IPv4 address.
Both can result in flooding, but the reason is different. That distinction matters on evidence-based questions.
Flooding does not mean “send everywhere on the switch”
VLAN membership constrains Layer 2 forwarding. A VLAN 10 broadcast is not ordinarily flooded into VLAN 20 simply because both VLANs exist on the same physical switch. VLANs create separate Layer 2 broadcast domains.
If an IP design requires VLAN 10 to communicate with VLAN 20, a Layer 3 function must route between the subnets, subject to policy.
What if the destination is learned on the same port the frame entered?
If the switch's table says the destination MAC is reachable through the same interface on which the frame arrived, forwarding that frame back out that interface is unnecessary. This can occur when multiple devices are reachable behind another Layer 2 device on one switch port.
Dynamic MAC aging trades perfect memory for adaptable forwarding
Dynamic MAC entries are not intended to remain forever. If a host stays silent long enough, its entry can age out. Later traffic destined for that host may temporarily become unknown unicast and be flooded within the VLAN until fresh source traffic lets the switch relearn the host's location.
Follow the table as A and B communicate for the first time
| Event | What switch learns | Destination knowledge | Action |
|---|---|---|---|
| 1. A sends to B on port 3 | A → port 3 | B unknown | Flood within VLAN except port 3 |
| 2. B receives and replies on port 8 | B → port 8 | A known on port 3 | Forward reply only toward port 3 |
| 3. A sends again to B | Refresh A → port 3 | B known on port 8 | Forward only toward port 8 |
| 4. B becomes silent long enough to age out | B entry eventually removed | B unknown again | Next A→B may flood until B is relearned |
Swipe horizontally to follow the complete frame trace.
Do not confuse ARP's job with the switch's MAC-table job
ARP / neighbor resolution
A host uses ARP in IPv4 to resolve a local next-hop IPv4 address to a MAC address.
Switch MAC table
A switch learns which port/VLAN is associated with observed source MAC addresses so it can make Layer 2 forwarding decisions.
A host may first need ARP to discover a destination or gateway MAC. The resulting Ethernet frames then give the switch source-learning opportunities. Related mechanisms participate in the same exchange but solve different problems.
The destination MAC can change hop by hop even when the IP destination does not
Read the MAC table as evidence, not as a verdict
| Observation | Reasonable inference | What it does not prove | Next evidence |
|---|---|---|---|
| Source MAC absent after host should transmit | Expected Layer 2 evidence is missing | Exact root cause | Link/port/VLAN + capture/host activity |
| MAC learned in wrong VLAN | Placement/tagging mismatch is plausible | Why configuration is wrong | Access/trunk config and design |
| MAC moves once after user relocates | Could be normal mobility | A loop | Timing/topology/context |
| MAC rapidly alternates between ports | Loop/duplicate identity becomes concerning | Which device caused it | Topology, STP, port logs, captures |
| Correct same-VLAN MAC learning, remote access fails | Shift toward Layer 3/policy | That routing is definitely broken | Gateway, routes, ACL/firewall evidence |
Swipe horizontally to see the complete evidence table.
Change one fact and watch the forwarding answer change
B unknown → B known
The first A→B frame may flood; after B is learned, later A→B traffic can be targeted to B's learned port.
Same VLAN → different VLAN
Pure Layer 2 switching no longer supplies direct inter-VLAN communication; a Layer 3 forwarding function is required.
B entry present → aged out
The next A→B frame can revert from known-unicast forwarding to unknown-unicast flooding.
Destination port different → same as ingress
The switch no longer needs to send the frame back out that same interface.
A stronger answer explains the decision, not just the vocabulary
Instead of writing “the switch floods,” write: “The switch learns the source MAC on the ingress port, cannot find the destination MAC in the VLAN's forwarding table, and therefore floods the unknown-unicast frame to eligible ports in that VLAN except the ingress port.”
That answer shows mechanism, evidence, scope, and consequence. It also transfers to troubleshooting questions where you must explain why a packet capture or MAC-table artifact changes your diagnosis.
Six statements students should be able to correct
- “A switch learns destination MACs.” It learns locations primarily from source MACs observed on incoming frames.
- “Unknown unicast goes to every VLAN.” Flooding is constrained by the VLAN/broadcast-domain context.
- “Broadcast and unknown unicast mean the same thing.” They may both flood, but for different reasons.
- “A missing MAC entry proves the host is offline.” Dynamic aging or lack of recent source traffic can also explain it.
- “Same-switch means same broadcast domain.” VLANs can create separate Layer 2 domains on one physical switch.
- “A switch needs the destination IP to pick an access port.” Ordinary Layer 2 forwarding uses the destination MAC and VLAN context.
24 frame-forwarding flashcards
Use these to practice the actual reasoning sequence: source learning, destination lookup, forwarding scope, aging, evidence interpretation, and changed facts.