the MAC address table

The MAC address table is a switch's memory of who sits where. It is the little notebook the mail-room clerk keeps: each line says a MAC address and which port reaches it. When a frame needs delivering, the switch flips to this notebook, finds the destination's line, and sends the frame out that port only.

Each entry maps a MAC address to an outgoing port, plus a freshness timer. The switch fills the table automatically through MAC learning: every frame's source address teaches it a (MAC, port) pair. Forwarding a frame is then a single lookup. If the destination MAC is in the table, the switch unicasts out that one port; if it is missing, the switch floods the frame out all other ports; broadcast and multicast addresses are always flooded. Entries that have not been seen for a while are aged out and removed, so the table reflects the current network and stays small. The lookup must be fast even at line rate, so hardware switches store it in special content-addressable memory (CAM), which is why it is often called the CAM table.

This table is also why a switch's behaviour is dynamic, not fixed. Move a laptop to a different port and within seconds its next frame re-teaches the switch the new location and the old entry ages out. The table has a finite size, though — fill it with junk and the switch is forced to flood everything, which both hurts performance and lets an attacker see traffic that should have been private.