Switching basics: MAC learning & flooding

Frames, MACs, and the L2 game

An Ethernet switch operates at Layer 2. It does not look at IP addresses; it makes forwarding decisions based on the destination MAC address in the frame header. Every interface on every device has a unique 48-bit MAC address, written like 00:1A:2B:3C:4D:5E.

A switch starts life knowing nothing. As traffic arrives, it observes the source MAC in each incoming frame and records: 'MAC X is reachable through port Y'. Over time, the switch builds a complete map of which MAC sits where.

Flood vs forward

When a frame arrives, the switch looks up the destination MAC in its table:

• Hit — the destination MAC is known: forward only out the matching port.
• Miss — the destination MAC is unknown: flood the frame out every port except the ingress port.
• Broadcast (FF:FF:FF:FF:FF:FF) — always flood, regardless of table state.

Walking through a first conversation

Imagine PC1 wants to ping PC2. PC1 sends an ARP request — a broadcast frame asking 'who has 10.0.0.20?'. The switch floods it to every port. PC2 replies; the reply is a unicast frame back to PC1's MAC. The switch now learns PC2's MAC against PC2's port. From then on, traffic between PC1 and PC2 is forwarded directly — no flooding required.

Hubs, switches, and why hubs lost

A hub is a Layer 1 device — a multi-port repeater. Every frame goes out every other port, every time. There is no learning, no forwarding logic, just electrical repetition. This means every hub creates one giant collision domain, and any two hosts transmitting at once corrupt each other.

A switch creates one collision domain per port. Hosts can transmit simultaneously without interfering, dramatically increasing usable bandwidth. This is why hubs disappeared from production networks two decades ago.