033
Daily Dose of Curious
HOW IT WORKS
Entries do not live forever — a Cisco switch forgets an address it has not heard from in five minutes. That is why a laptop moved to a different port still works, and why a network with a loop in it can drown in flooded frames long before anyone notices the loop.
It writes down where every device is as it hears from them. A switch reads the sender's address on every frame that arrives and notes which port it came in on. That table is the whole trick.
What actually happens
A frame arrives
It carries a source address and a destination address. The switch looks at the source first, which is the opposite of what you would expect.
The switch learns
It writes the source address against the port the frame came in on. Now it knows where that device is, for the next few minutes.
It looks up the destination
If that address is already in the table, the frame goes out of that one port and nowhere else.
If it is not in the table
The frame goes out of every other port in the VLAN. That is flooding, and it is a switch admitting it does not know yet.
The clever bit
A switch never asks anything. It learns entirely by overhearing, and it learns from the sender of a frame while delivering it to somebody else. The table is a side effect of doing its job.
The words
- Frame
- One parcel of data on a local network, wrapped in addresses the switch can read.
- Flooding
- Sending a frame out of every port except the one it arrived on, because the switch does not know where the destination is.
Where this comes from
- IEEE 802.1D — the bridge learning and forwarding behaviour
- Default MAC address-table ageing on Cisco switches is 300 seconds
This one is not an opinion. It is how the thing works, and these are what that rests on.