# How does a switch learn MAC Addresses **URL:** \ **Category:** Lessons Discussion\ **Created:** [December 20, 2016, 10:01pm UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865 "2016-12-20T22:01:58Z")\ **Posts on this page:** 20\ **Page:** 5
**Author:** ![mrigendram0](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/m/a8b319/32.png) [@mrigendram0](https://forum.networklessons.com/u/mrigendram0)\ **Post date:** [August 26, 2020, 8:27pm UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/84 "2020-08-26T20:27:31Z")
@ReneMolenaar Why MAC address is required when we have IP address to communicate ? or Why IP address is required, can’t we communicate on the basis of MAC address only ? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [August 28, 2020, 4:49am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/85 "2020-08-28T04:49:29Z")
Hello M M The MAC and IP addresses are used together to allow network devices to communicate with each other. IP addresses allow the communication from end to end while MAC addresses are used within a specific subnet. Think about it this way. If I was to give you my postal address, and I told you the number of my house on my street is 176, that would not give you enough information for you to find me. If you had already reached my street, then yes, you could find me with just that information. The same is true of the MAC address. If I gave you the MAC address of my web server, you would not be able to reach it from your computer. But if I gave you my IP address, you would reach my network, and then using the MAC address (learned via ARP), you could communicate with the specific device on my network. Remember that network communication functions in layers. The Network Layer is responsible for routing from end to end of a communication, and uses the IP protocol, while the Data link layer, where MAC addresses are used, is responsible for getting a frame to the appropriate device within a network segment. It is indeed difficult to get your head around it especially if it is the first time you are going over these topics. It will take time, but I suggest you go over the following lessons which will help you understand more fully: > **[Introduction to the OSI Model](https://networklessons.com/network-fundamentals/introduction-to-the-osi-model)** > > This lesson is an introduction to the OSI model for networking students. We explain the different layers and their functions with examples. > **[TCP/IP Stack Tutorial](https://networklessons.com/network-fundamentals/tcpip-stack-tutorial)** > > This lesson explains the TCP/IP Stack and we'll take a look at the difference between the TCP/IP Stack and the OSI model. Also, take a look at the CCNA course linked below, and focus on Unit 2: Network fundamentals, which includes all of this information. > **[CCNA 200-301 - NetworkLessons.com](https://networklessons.com/cisco/ccna-200-301)** > > The CCNA 200-301 course explains everything you need to know to prepare for and pass the Cisco CCNA 200-301 exam. I hope this has been helpful! Laz ---
**Author:** ![pradyumnayadavgla](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/p/f9ae1b/32.png) [@pradyumnayadavgla](https://forum.networklessons.com/u/pradyumnayadavgla)\ **Post date:** [September 6, 2020, 1:47pm UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/86 "2020-09-06T13:47:23Z")
Hi Laz, I have a question here is that, can switch simultaneously learn multiple mac on single interface yes then how much at a time until aging timer expired ? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [September 10, 2020, 7:33am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/87 "2020-09-10T07:33:42Z")
Hello Pradyumna Yes, a switch can indeed learn multiple MAC addresses on a single port. For example, if you have two switches connected together, and you have 10 hosts connected to one switch, and 10 connected to the other, the ports connecting the two switches will register multiple MAC addresses in the MAC address table, whenever there is communication between hosts on each switch. The ageing timer for MAC addresses remains the same (300 seconds by default) and is not affected by the number of MAC addresses that may register in the MAC address table on a particular interface. I hope this has been helpful! Laz ---
**Author:** ![pradyumnayadavgla](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/p/f9ae1b/32.png) [@pradyumnayadavgla](https://forum.networklessons.com/u/pradyumnayadavgla)\ **Post date:** [September 13, 2020, 12:36pm UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/88 "2020-09-13T12:36:05Z")
Thanks Laz clearly get it ---
**Author:** ![ntlipcore](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/n/a183cd/32.png) [@ntlipcore](https://forum.networklessons.com/u/ntlipcore)\ **Post date:** [September 15, 2020, 5:54pm UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/89 "2020-09-15T17:54:36Z")
Hi Dear, In example explained by you in this lesson, you said a switch is a layer 2 device how a layer 2 device is utilizing layer 3 ICMP utility (Ping)? If its not L3/manageable switch? Please Explain ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [September 17, 2020, 5:36am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/90 "2020-09-17T05:36:47Z")
Hello Ntlipcore There are various concepts you mention in your post that require clarification in order to understand the concept of Layer 2 and Layer 3 devices. - A managed switch is a switch that you can connect to a management interface and change its configuration. A managed switch can be a Layer 2 switch or a Layer 3 switch. - A managed Layer 2 switch must be able to have an IP address, so that you can connect to it using Telnet or SSH (or HTTP as well) in order to configure it over the network. On a Cisco switch, this is typically done by [creating an SVI](https://networklessons.com/cisco/ccna-routing-switching-icnd1-100-105/ipv4-address-configuration-on-cisco-ios-catalyst-switch) on one of the VLANs and assigning it an IP address. This means that the switch, even though it is Layer 2, can ping to and from its IP address. - A Layer 3 switch is one that can perform [inter-VLAN](https://networklessons.com/cisco/ccna-routing-switching-icnd1-100-105/intervlan-routing) routing. A Layer 2 switch cannot. I hope this has been helpful! Laz ---
**Author:** ![gowthamraj4](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/g/898d66/32.png) [@gowthamraj4](https://forum.networklessons.com/u/gowthamraj4)\ **Post date:** [September 24, 2020, 7:31pm UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/91 "2020-09-24T19:31:42Z")
Hi, If the switch interface is not learing the mac address but the inerface is up, In this case what all are the possible reasons behind this… ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [September 26, 2020, 8:35am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/92 "2020-09-26T08:35:45Z")
Hello Gowthamraj If a switch receives a frame on a port it will always populate the MAC address table with the MAC address in the source field of the header. Always. The only exception to this rule is the listening state of the STP process, where a port is up, but it is not yet learning MAC addresses. It is just listening for any new BPDUs that may indicate a topology change. More on these port states can be found here: > **[Spanning Tree Port States](https://networklessons.com/spanning-tree/spanning-tree-port-states)** > > This lesson explains the Spanning Tree port states: Listening, Learning, Forwarding and Blocking. I don’t know of any other situation where a switch port is up and is not recording the MAC addresses on the frames it receives in the MAC address table. I hope this has been helpful! Laz ---
**Author:** ![pradyumnayadavgla](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/p/f9ae1b/32.png) [@pradyumnayadavgla](https://forum.networklessons.com/u/pradyumnayadavgla)\ **Post date:** [October 3, 2020, 11:46am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/93 "2020-10-03T11:46:14Z")
Hi Laz, I have a doubt that when switch sends arp and when ethernet frame b/c here we are having pc than it must be having ip address so why it did not send arp instead of frame? actually i am very confused that whenever any host in a network want to communicate with other host what and when it will send Arp, frame, packet ? please clarify this? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [October 9, 2020, 4:43am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/94 "2020-10-09T04:43:24Z")
Hello Pradyumna > [@pradyumnayadavgla](#): > > I have a doubt that when switch sends arp and when ethernet frame b/c here we are having pc than it must be having ip address so why it did not send arp instead of frame? A switch will only send whatever is being sent through it. The ARP requests, frames, and packets are sent by the hosts, and are simply retransmitted by the switch. All hosts maintain an ARP table that has a list of MAC to IP address mappings. If the destination IP of a packet a host wants to send does not have a corresponding MAC address in that ARP table, then it sends out an ARP request to learn the MAC address. Once it gets that information, it populates the Ethernet header and sends it out to the switch. So an **ARP request** is sent by a **host** that does **not know** the **MAC address** of the **destination** it wants to send a packet to. > [@pradyumnayadavgla](#): > > actually i am very confused that whenever any host in a network want to communicate with other host what and when it will send Arp, frame, packet ? please clarify this? A frame and a packet are words that specify the protocol data unit (PDU) of the particular layer of the OSI model. They are the same thing, but are described at a different level. A packet is encapsulated into a frame before being sent out onto the network. Even an ARP request is encapsulated into a frame as well. Take a look at the following lesson about the OSI model that further explains these concepts. I hope this has been helpful! Laz ---
**Author:** ![dnv21](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/d/a3d4f5/32.png) [@dnv21](https://forum.networklessons.com/u/dnv21)\ **Post date:** [May 7, 2021, 7:42am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/95 "2021-05-07T07:42:37Z")
Is there a way to prevent a mac address x.y.z from being learnt on a particular interface Gi1/0/3 ? I tried MAC-ACL and it only acts in forwarding plane ie blocks forwarding from a source but doesn’t prevent learning happen of this mac on the interface ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [May 10, 2021, 4:42am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/96 "2021-05-10T04:42:01Z")
Hello Venka Port security is a feature of switches that can be used to limit the MAC learning as well as the access of devices with specific MAC addresses to particular ports. You can specify which MAC addresses are allowed on a particular port. Any frames with disallowed MAC addresses will be blocked and will not be learned by the switch. You can find out more information about this feature at the following lesson: > **[How to configure port-security on Cisco Switch](https://networklessons.com/switching/how-to-configure-port-security-on-cisco-switch)** > > Port-security can be used to filter MAC-addresses on Cisco switches. In this lesson you will learn how it works and how to configure it. I hope this has been helpful! Laz ---
**Author:** ![syncope988](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/syncope988/32/1385_2.png) [@syncope988](https://forum.networklessons.com/u/syncope988)\ **Post date:** [May 13, 2021, 5:25am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/97 "2021-05-13T05:25:42Z")
Hi Rene and staff, there is a huge amount of information in the forum, so it is hard to be sure an answer to a question is not already in it; so i apologize if this is the case i am reviewing the switch mecanism: perhaps it is basic but my CCNA is far away Except for bad frames, I am very surprised that a switch do not drop UNICAST frames when the dest MAC is unknown: on the contrary it floods the frame on all other ports ( i cannot find the word drop in the web page) I am talking only about UNICAST (flooding broadcast or all kinds of multicast frames is OK) For unicast frames with ipv4, the sender has to build the frame using ARP, so there is only 3 cases: - the sender already knows the dest MAC: it can build and send the frame - the sender does not know the dest MAC; it sends an ARP request and gets a reply, so it can build and send the frame - the sender does not know the dest MAC; it sends an ARP request and does not get a reply, so it CANNOT build the frame; consequently it cannot send the frame and drops the frame (that is the sender, not the switch) So first, in what context a SW would receive a UNICAST frame with an UNKNOWN dest MAC ? 1. suppose that a legitimate sender (with an approved MAC source) has a malicious program in it and is not aware of it: that program builds and sends frames permanently with an unknown unicast dest MAC (= that will never be present on the LAN); so in this case, the SW will flood permanently these frames on the other ports ? Also i am sure you can put rate limits to solve this issue, the best way for the SW would be to drop the frame with unknown UNICAST dest MAC ? Could you clarify ? Take the example below with a bridge ![image](https://cdn-forum.networklessons.com/uploads/default/original/2X/9/99c862de229563440dbb3de9f6d52cd283e29401.png) which segments the LAN in two parts Suppose A sends an UNICAST frame to C that does not exist on the LAN: does the bridge flood the frame on the other segment or drop the frame ? i am confused, could you clarify ? Regards ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [May 14, 2021, 7:51am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/98 "2021-05-14T07:51:24Z")
Hello Dominique > [@syncope988](#): > > So first, in what context a SW would receive a UNICAST frame with an UNKNOWN dest MAC ? It all has to do with timers. The default MAC address table timeout is 300 seconds or 5 minutes. If a host has an ARP table timeout that is larger than that, then you can have a situation where the destination MAC address is not in the MAC address table of the switch, but still exists in the ARP table of the host. So the host will send a frame with that destination MAC without sending an ARP packet. The switch will not have the MAC address in its table, and will flood the frame. Another case where you will have unicast flooding is in the case of asymmetric routing, something that is further described in this lesson: > **[Unicast Flooding due to Asymmetric Routing](https://networklessons.com/switching/unicast-flooding-due-to-asymmetric-routing)** > > Asymmetric routing can cause flooding of unknown unicast traffic. This lesson explains why this happens and how to deal with it. Additional causes of flooding can be found in this Cisco document: > **[Unicast Flooding in Switched Campus Networks](https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6000-series-switches/23563-143.html)** > > This document discusses possible causes and implications of unicast packet flooding in switched networks. Now how do you deal with this flooding? There are several things you can do. 1. Make sure your network design is correct so that the situations in the above stated documentation and links are avoided. 2. Use the `switchport block unicast` command on Cisco IOS switches. More about this can be found at [this Cisco documentation](https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/31sg/configuration/guide/conf/uniflood.html). 3. You can also use the `switchport protected` command, more about which you can read at [this Cisco documentation](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/interface/command/ir-cr-book/ir-s7.html#wp2158509592). > [@syncope988](#): > > Suppose A sends an UNICAST frame to C that does not exist on the LAN: does the bridge flood the frame on the other segment or drop the frame ? The switch will continue to flood the frame unless one of the above configurations is implemented. I hope this has been helpful! Laz ---
**Author:** ![ananth.gmk](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/a/6a8cbe/32.png) [@ananth.gmk](https://forum.networklessons.com/u/ananth.gmk)\ **Post date:** [March 2, 2022, 7:47am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/99 "2022-03-02T07:47:49Z")
Why the trunk port of SW1 learns about the hosts connected to SW2 but not learning the hosts connected to itself? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [March 4, 2022, 11:00am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/100 "2022-03-04T11:00:17Z")
Hello Ananth A switch will populate its MAC address table based on the **source** MAC address of **incoming** frames on a **particular port**. For this reason, Gi0/3 (regardless of whether it is configured as an access or trunk port) will have MAC table entries only for the MAC addresses of H3 and H4. This is because you will never see an incoming frame with a source MAC address of H1 or H2 on Gi0/3. Those MAC addresses are recorded as corresponding to Gi0/1 and Gi0/2, respectively, **which will see incoming frames with those MAC addresses in the source field**. I hope this has been helpful! Laz ---
**Author:** ![rahulchaudharys850](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/r/41988e/32.png) [@rahulchaudharys850](https://forum.networklessons.com/u/rahulchaudharys850)\ **Post date:** [March 25, 2022, 4:09pm UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/101 "2022-03-25T16:09:41Z")
I have one question here. ![switch-mac-address-table](https://cdn-forum.networklessons.com/uploads/default/original/2X/a/a93a0335008e933275187a9dc2e089c35341bc7a.png) What if H1 send packet without source mac address(blank) and destination address as H2. In that case what switch will do? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [March 28, 2022, 6:00am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/102 "2022-03-28T06:00:18Z")
Hello Rahul A host cannot have a blank value for the source MAC address in the header of the Ethernet frame. The possible values for the 48 bit MAC address range (in hex) from 00:00:00:00:00:00 to FF:FF:FF:FF:FF:FF, so you can’t have a blank value. The special case of 00:00:00:00:00:00 is used for localhost MAC address or it is used in ARP requests as the target hardware address whenever this is unknown, but in such cases, the field is ignored. I hope this has been helpful! Laz ---
**Author:** ![nitin.28.arora](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/n/3ec8ea/32.png) [@nitin.28.arora](https://forum.networklessons.com/u/nitin.28.arora)\ **Post date:** [July 14, 2022, 4:33am UTC](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865/103 "2022-07-14T04:33:08Z")
Hello Laz, thanks for responding earlier responses on my queries. Pls confirm that do mac-learning-limit on port channel in Dell switches restricts dhcp behaviour of IPv6? Is it so? BR// Nitin Arora [Previous page](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865.md?page=4) [Next page](https://forum.networklessons.com/t/how-does-a-switch-learn-mac-addresses/865.md?page=6)