When does a switch flood a frame instead of forwarding it?
I thought switches always "know" where to send frames — that's their whole job. But I keep seeing frames go out every port in the lab animation. What triggers flooding?
1 Answer
A switch only knows what it has learned. It builds its MAC table from source addresses of frames it receives; a destination it hasn't seen yet is an unknown unicast, and the only safe move is flooding: send it out every port in the VLAN except the ingress. Same for broadcasts (always flooded, by definition) and most multicast without snooping. Once the destination replies, its source MAC gets learned and the conversation collapses to a two-port unicast path. This is also why security features like port security exist — MAC learning is trusting by default. Watch it live in the lab: clear the MAC table (clear mac), ping, and the first frame floods while the reply gets forwarded precisely.