How does a switch learn MAC Addresses

Hi Wisam,

You mean you configured an IP address on the printer? Once the switch receives a single Ethernet frame on an interface, it will learn the MAC address. Most network printers use DHCP client to get an IP address by default so even if you take it out of the box and plug in the power, it should generate some network traffic.

You can also connect a laptop with Wireshark directly to your printer, see if it generates any traffic.

Hi Rene,
Does switch have mac address? if yes, when and how it will be the use?

Hello Mohammad

Yes, all switches have a MAC address. How this MAC address is implemented depends on the vendor. Some switches have the same MAC address on all ports. Cisco switches have a different MAC address on each port and one main MAC address that refers to the switch itself. These MAC addresses are only used for traffic that is destined to or generated from the switch itself. For traffic from one PC to another for example, these MAC addresses don’t play any role.

Some specific uses for the MAC addresses of switches include:

* terminating traffic to and from the switch itself
* determining the root bridge when using STP

I hope this has been helpful!


Hi Rene,
I understood ARP and Switching (I hope). Thank you for a very good explanation as always.
My question-- is it the host who always start the ARP process? Does a switch ever get chance to initiate ARP?

I believe there is a difference. Unknown is a case of unicast. In unicast the source and destination address are present and they are unique (I mean individual value). But in case of broadcast, it is intended for all hosts in the network (FF:FF:FF:FF:FF:FF).

Now the interesting thing is how the receivers will react to the unicast and broadcast. In case of unicast, only the host with a matching destination address will respond but rest will simply drop the packet. But in case of broadcast, there will be a reply from each of the receiving hosts to the source MAC. @andrew Please correct me if my understainding is not appropriate.

Hi Rosna,

Any device that has an IP address needs ARP. After all, if it wants to send an IP packet with a destination IP address, it has to figure out what the layer two MAC address is.

On a layer two switch, you still might want to configure an IP address. Here are some reasons:

- To manage it remotely through telnet or SSH.
- So it can send syslog messages to an external server.
- So you can use SNMP to monitor the switch.

It is possible that a switch is the initiator of the ARP process. For example, perhaps you just rebooted it and it wants to send syslog information to some syslog server…in that case, it will send an ARP request for the syslog server that you have configured on the switch.

Hope this helps!


1 Like

Rene, please check the link for the ARP lesson due it brings to me to the Course section.

Hello Juan.

Here’s the correct link to the lesson you’re looking for:

I’ll let Rene know about the broken link in his message…

I hope this has been helpful!


In your example, H1 is trying to send traffic to H2 and H1 already knows the MAC of H2. So I understand H1 knows the dest MAC due to sending an ARP. However, if it had sent an ARP, why is the switch mac address table empty? Wouldn’t the switch already have the mac address for H2 in its table due to the arp reply that told H1 what H2’s mac address was?

1 Like

Hello David

You are absolutely right. The switch would know the MAC address of H3 due to the ARP request it had originally sent. However, this procedure of the ARP request and response is not included in the example for simplicity, so that we can focus on the way in which the switch learns MAC addresses via frames sent between devices.

Thanks for the insight.


In response to the comment on Oct. 13:

Rene’ jumped ahead of himself just a bit at the beginning of the video. Initially, computer A will not know the destination MAC address of computer B. The initial frame Rene drew would have a source MAC of AAA and a destination MAC of FF:FF:FF:FF:FF:FF (“all ones”) so that the switch is forced to flood the frame out all ports (and as Rene’ noted, it will flood it anyway in this case because the switch initially hasn’t learned what port it can reach MAC address BBB on).


In your first drawing, host AAA already knows about host BBB. For those new to this, I think it would be helpful to redraw that first pic and show the destination mac address of FFF and go on to explain how host AAA would send its first frame (destined for host 2) with a destination mac address of FFF (since it hasn’t communicated with host 2 yet) and how that frame would reach all devices (since it is a broadcast frame).

Hello Andy

Actually, the destination MAC address in the frame will not be the broadcast MAC address, but it will be the MAC address of the destination host, H2. The frames as they are displayed in both the video and the images are correct.

If the switch does not have the MAC address of H2 in its address table, it will receive the frame and flood it out of all of its ports except the port on which it arrived. All hosts will receive the frame and check the destination address of BBB and compare it to their own. H3 will discard it, however H2 will keep it because its MAC address matches the destination MAC address. This is how devices know that a frame that arrives on their NIC belongs to them (or not).

If the address was the broadcast MAC address of FF:FF:FF:FF:FF:FF, then all devices would accept the frame and begin decapsulating it, because it is a broadcast and broadcasts are intended for everyone.

Now you mentioned that A will NOT know the destination MAC address of computer B. In this example, A does know the destination MAC address. However, if it does not, then another mechanism, independent of that shown in this lesson, would be used to learn this MAC address. This mechanism is known as an ARP request. You can find out more about this at the following lesson:

I hope this has been helpful!


thanks for this good video.
I understand that, in the second figure, when an ethernet frame start from H1and is sent to H4, the source mac is fa016.3E40.F97D (from H1) and the destination mac is fa16.3E02.9079 (to h4).
My question is : when this ethernet frame travel from sw1 to sw2, does the sours or destination mac change to sw1 mac or sw2 mac (theses mac are not shown in the figure) ? or does it keep the same source and destination mac address along all its way until the end ?(withe H1 and H4 and all teh equipments which stay in the same broadcast domaine. no router here)

Then this command on sw1 (or sw2) :
show cdp neighbors detail
will show mac address which probably never been present on the mac address table : the mac of the other switch.
Am i ok ?

Hello Hugues

Yes, your thoughts are correct. The MAC address will remain the same for the whole trip of the frame since both H1 and H4 are in the same subnet/network segment. MAC addresses will only change when they are routed by routers. Source and Destination MAC addresses change for every hop from router to router.

Now, the MAC address you’ll see when you use the CDP neighbors command is the MAC of the switch itself. You will only see MAC address of SW1 in the MAC address table of SW2 only if there was a frame whose source is SW1, such as a ping from the command line interface of SW1. Transient traffic, that is, traffic that the switch receives and forwards, does not incorporate the MAC address of SW1 in any way.

I hope this has been helpful!


If the switch doesn’t see a particular MAC address for 300 seconds, it will be removed from the MAC address table

Hi Rene , that is mean if particular mac address not active for 300 seconds ? if it active it never cleaned from mac table until reboot ?

Hello Emil

The MAC address table is populated by the source MAC address found in each frame that enters a port. Every time a frame enters a port of a switch, the source MAC address is read. This source MAC address is compared to all the MAC addresses in the MAC address table. If it exists in the table, then the timer associated with that address is reset to 300 seconds. If it is not found in the table, it is added, and the timer associated with that address is set to 300 seconds.

If the timer of 300 seconds goes to zero, that means that no additional frames with that source MAC address have been detected on any ports, thus the MAC address times out and is removed. So if you have a frame coming from a specific MAC address at least once every 300 seconds, that MAC address will always remain within the MAC address table.

I hope this has been helpful!


i have a question suppose i ping a to b on switch 1- we know only the ip address right, how will switch know dest mac is ---------------to forward a frame

Hello Rakshit

If you have host A and host B connected to a switch, and one host pings the other, then the process is as follows:

  1. Host A knows the IP address of host B, and encapsulates an IP packet with the appropriate addresses in the header.
  2. This IP packet is then encapsulated within an Ethernet frame which has a header that contains the source and destination MAC address. The source address is known (MAC of host A) but the destination MAC address must be determined. This is done using ARP, and you can find out more about how it works in detail at the ARP (Address Resolution Protocol) Explained lesson.
  3. Once the MAC addresses are written in the Ethernet header, the frame is placed on the wire and sent to the switch.
  4. The switch will read the Ethernet header and see the destination MAC address, and based on the MAC address table, will forward the frame out the appropriate port. If no entry is found in the MAC address table, it will flood the frame out all ports except the incoming port.

So the switch does learn the MAC address of the destination using ARP.

I hope this has been helpful!


@lagapides Thanks for the Reply, how does this work in case of layer 3 switch

user vlan 10(>l3 switch -------------------->user in vlan 20(

how does a packet flow in this case since switch switch has only one mac and 2 svi for both users in vlan 10 and 20 what would be destination packet since it is on the same switch