Introduction
A MAC (Media Access Control) address is a hardware identifier assigned to a network interface, used at the data link layer to identify devices on a local network segment. Switches use MAC addresses to decide where to forward frames within a LAN, which is fundamentally different from how routers use IP addresses to forward packets between networks.
Cricket analogy: A player's fixed shirt number stitched onto their kit (their identity within the team) is like a MAC address used by the team's internal roster, fundamentally different from the ICC's country codes used to route a player between international squads, like IP addresses between networks.
Explanation
A MAC address is 48 bits long, typically written as six pairs of hexadecimal digits separated by colons or hyphens, e.g. 00:1A:2B:3C:4D:5E. The first 24 bits (three octets) form the Organizationally Unique Identifier (OUI), assigned by the IEEE to the manufacturer of the network interface; the remaining 24 bits are assigned by the manufacturer to uniquely identify that specific interface. MAC addresses are intended to be globally unique and are burned into the network interface hardware (though they can be overridden in software).
Cricket analogy: A player's shirt number is really two parts — the first three digits show which academy trained them (like the IEEE-assigned OUI for the manufacturer) and the last three uniquely identify the individual player, permanently sewn on but technically replaceable, just like a MAC address's manufacturer prefix and unique suffix.
A switch is a Layer 2 device that connects multiple devices on a LAN and forwards Ethernet frames based on destination MAC addresses. It maintains a forwarding table, often called a MAC address table or CAM (Content Addressable Memory) table, that maps MAC addresses to the physical switch ports on which those addresses were last seen.
Cricket analogy: A team's dressing-room attendant keeps a running list of which peg each player's kit hangs on, so when a message arrives for a specific player, it goes straight to their peg instead of being shouted at the whole room, just like a switch's CAM table mapping MAC addresses to ports.
The switch learns MAC addresses dynamically: whenever a frame arrives on a port, the switch reads the frame's source MAC address and records (or updates) an entry mapping that source MAC to the incoming port, along with a timestamp/aging timer. This is called MAC address learning, and it happens continuously and automatically as traffic flows through the switch.
Cricket analogy: Every time a player checks into the dressing room through a specific door, the attendant notes which door they used and updates the peg list, refreshing the note each time so it doesn't go stale, just like a switch learning source MAC addresses and updating its table with an aging timer.
The forward-vs-flood decision works like this: when a frame arrives, the switch looks up the frame's destination MAC address in its CAM table. If a matching entry exists, the switch forwards the frame only out the specific port associated with that MAC address (unicast forwarding) — it does not send it out other ports. If no matching entry exists (the destination MAC is unknown to the switch), or if the destination is the broadcast address (FF:FF:FF:FF:FF:FF), the switch floods the frame out every port except the one it arrived on, so it reaches every device on the segment; whichever device owns that MAC will respond, letting the switch subsequently learn its location from the reply's source address.
Cricket analogy: If the dressing-room attendant knows exactly which peg a message is for, they deliver it straight there; but if the recipient's peg is unknown, they announce it to the whole room until the right player responds, after which the attendant notes their peg for next time, just like a switch's forward-versus-flood decision and subsequent learning.
Example
# Simplified simulation of switch MAC learning and forward/flood logic
cam_table = {} # mac_address -> port
def receive_frame(src_mac, dst_mac, in_port, all_ports):
# Step 1: learn the source MAC on the incoming port
cam_table[src_mac] = in_port
# Step 2: decide forward vs flood based on destination MAC
if dst_mac in cam_table:
out_port = cam_table[dst_mac]
print(f"Forward: frame from {src_mac} to {dst_mac} sent only out port {out_port}")
else:
flood_ports = [p for p in all_ports if p != in_port]
print(f"Flood: {dst_mac} unknown, frame sent out ports {flood_ports}")
ports = [1, 2, 3, 4]
# Frame 1: host on port 1 sends to an unknown MAC -> flood
receive_frame("AA:AA:AA:00:00:01", "BB:BB:BB:00:00:02", in_port=1, all_ports=ports)
# Frame 2: the host with BB:BB:BB:00:00:02 replies from port 3 -> switch learns it
receive_frame("BB:BB:BB:00:00:02", "AA:AA:AA:00:00:01", in_port=3, all_ports=ports)
# Frame 3: port 1 sends to BB:BB:BB:00:00:02 again -> now a known entry, forward only
receive_frame("AA:AA:AA:00:00:01", "BB:BB:BB:00:00:02", in_port=1, all_ports=ports)Analysis
Running the simulation above shows the classic learn-then-forward pattern: the first frame to an unknown destination is flooded to all ports (except the source), which lets the destination device see it and reply; that reply lets the switch learn the destination's real MAC-to-port mapping; from then on, matching traffic is forwarded efficiently to only the correct port instead of flooding. This is strictly a Layer 2 process based on MAC addresses within a single broadcast domain — it should never be confused with routing, which is a Layer 3 process using IP addresses to move packets between different networks/subnets. A switch has no concept of IP addresses in its core forwarding decision; a router has no concept of MAC-address-based flooding across a whole segment.
Cricket analogy: The first time a new substitute's name is called, the whole dressing room has to be told who they are before someone points them to their peg; after that, messages go straight there — but this internal dressing-room system is nothing like the ICC's international transfer paperwork that moves players between entirely different countries, which is a completely separate process, like Layer 3 routing versus Layer 2 switching.
Key Takeaways
- A MAC address is 48 bits, written as six hex octets; the first 24 bits (OUI) identify the manufacturer.
- Switches learn MAC addresses by recording the source MAC and incoming port of every frame they see.
- If the destination MAC is known in the CAM table, the switch forwards the frame out only that port; if unknown (or broadcast), it floods out all other ports.
- Switching (Layer 2, MAC-based, single segment) is fundamentally different from routing (Layer 3, IP-based, across networks).
Practice what you learned
1. How many bits make up a standard MAC address?
2. What do the first 24 bits of a MAC address typically represent?
3. How does a switch learn which port a particular MAC address is reachable on?
4. What does a switch do when it receives a frame for a destination MAC address not in its CAM table?
Was this page helpful?
You May Also Like
Data Link Layer Basics
How raw bits are organized into frames for reliable node-to-node delivery on the same network segment.
Hubs, Switches, and Routers
Learn how hubs, switches, and routers operate at different OSI layers and how they shape collision and broadcast domains.
Ethernet Standards
Common Ethernet naming and speeds (10BASE-T to Gigabit and beyond) and why CSMA/CD is largely obsolete on modern switched networks.
VLANs
How VLANs use 802.1Q tagging to logically split one physical switch into multiple isolated broadcast domains.