Table of Contents |
Switches keep track of which devices are connected to each port using a database called the MAC address table, also known as the Content Addressable Memory (CAM) table.
When a frame enters a switch, the switch reads the source MAC address and records it in this table along with the port where it arrived.
This process lets the switch deliver future frames directly to the correct destination instead of sending them to every device on the network.
Shown here is a sample MAC address table. A switch records each MAC address and the port where it arrived. This table allows it to forward frames directly instead of flooding them.
| MAC Address | Port | VLAN |
|---|---|---|
| 00:1A:2B:3C:4D:5A | Gi1/0/1 | 10 |
| 00:1A:2B:3C:4D:5B | Gi1/0/2 | 10 |
| 00:1A:2B:3C:4D:5C | Gi1/0/3 | 20 |
| 00:1A:2B:3C:4D:5D | Gi1/0/4 | 20 |
When a switch first powers on, its MAC address table is empty. As it receives frames, it begins to learn where each device is located:
| MAC Address | Port |
|---|---|
| 00:1A:2B:3C:4D:5A | Gi1/0/1 |
| 00:1A:2B:3C:4D:5B | Gi1/0/2 |
00:1A:2B:3C:4D:5B is moved to port Gi1/0/4 and sends a new frame.
Now that you know how switches learn and forward frames, you can look at how they manage traffic that should not be forwarded.
Filtering means deciding whether a frame should be sent, ignored, or flooded. A switch performs filtering on every frame to reduce congestion, conserve bandwidth, and prevent unnecessary traffic from moving through the network.
When a switch receives a frame, it checks both the source and destination MAC addresses to decide what to do next. If the destination MAC address is known, the frame is sent only to that specific port. If the destination MAC address is unknown, the switch uses a process called flooding, which means temporarily sending the frame out of all ports in the same VLAN, except the one it came from. If the source and destination are on the same port, the switch filters the frame and does not forward it. There is no need to send data back to the same device. This intelligent decision-making ensures that each frame is handled efficiently, even in large or busy networks.
Switches also apply specific filtering techniques for different types of traffic.
When a frame arrives with a destination MAC address that is not in the MAC address table, the switch treats it as an unknown unicast frame. The switch does not yet know which port leads to the destination. Flooding is the default behavior for unknown unicast traffic. By flooding, the switch can discover the location of the new device when it replies. In some environments, administrators configure switches to drop unknown unicast frames instead of flooding them. This limits unrecognized or suspicious traffic and adds a layer of security.
A broadcast frame is a frame sent to the special MAC address FF:FF:FF:FF:FF:FF, which means that all devices in the local network should receive it. Broadcasts are used for essential network messages, such as ARP requests that help devices learn one another’s IP and MAC addresses. However, too many broadcasts can slow performance. Dividing a network into multiple VLANs limits the broadcast area, creating smaller and more efficient broadcast domains.
A multicast frame is designed for one sender to reach many recipients at once. For example, a server that streams video to several users sends multicast traffic. Modern switches use multicast filtering to forward multicast frames only to ports that have joined the multicast group. This prevents the switch from sending unnecessary traffic to every port in the VLAN.
Finally, every switch applies this same rule to prevent loops. By never forwarding a frame back out the port it arrived on, the switch avoids circulating traffic and sets the groundwork for more advanced loop-prevention protocols you will study later in the course.
So far, you’ve seen how switches forward and filter frames within a local network. In a small home network, that might be enough—every device shares the same space and can communicate freely. However, in a business or campus network, hundreds of devices might connect to multiple switches. Without a plan, all that traffic would mix together, making the network less secure and harder to manage.
To solve this, switches use two main port types that organize how traffic moves between devices and between switches: access ports and trunk ports.
An access port connects directly to an end device such as a computer, printer, or phone. It handles traffic for one local network. Frames that enter or leave an access port are untagged, meaning that the end device never sees any special information added by the switch. Inside the switch, each access port is assigned to a specific local network, so traffic from different groups stays separate. This helps isolate departments, control broadcast traffic, and reduce accidental access to other groups’ data.
A trunk port connects switches to one another or links a switch to a router. Trunk ports carry traffic for multiple local networks at the same time. Instead of using a separate physical cable for each network, a trunk allows all of them to share one link efficiently. To keep the traffic organized, the switch adds a small identifier to each frame, showing which local network it belongs to. This identifier is called a tag, and it follows the IEEE 802.1Q standard. The 802.1Q standard defines a universal tagging format in which any switch or router, no matter the manufacturer, can recognize and separate tagged traffic correctly. When a tagged frame leaves a trunk and reaches an access port, the switch removes the tag, allowing the end device to receive only its own local traffic.
Using access and trunk ports together allows networks to scale easily while keeping traffic organized and secure. Access ports connect individual devices to their correct local networks, while trunk ports connect switches so that each local network can extend across the larger system without its traffic getting mixed with that of others.
Source: THIS TUTORIAL WAS AUTHORED BY SOPHIA LEARNING. PLEASE SEE OUR TERMS OF USE.
