MAC learning

MAC learning is how a switch figures out where everyone is without being told. Think of a new receptionist on their first day: every time someone walks up to the desk, the receptionist notes which hallway that person came from. After a short while, the receptionist can route a visitor straight to the right person, just from having watched who came from where.

The mechanism is simple. Every frame carries a source MAC address. When a frame arrives on a port, the switch records the pair (source MAC, this port) in its MAC address table. So if a frame from address 11:22:33:aa:bb:cc enters on port 5, the switch now knows that machine is reachable via port 5. Later, when some other frame needs to reach 11:22:33:aa:bb:cc, the switch looks it up and sends it out port 5 alone. If a destination is not yet in the table, the switch floods the frame out every other port; the reply teaches the switch where that machine is, so flooding stops. Entries time out (a common default is around five minutes) so the table stays current when machines move or unplug.

MAC learning is what makes a switch self-configuring — you plug devices in and it just works, no manual setup. It is sometimes called backward learning because the switch learns the path to a machine from the frames that machine sends, not from the frames sent to it. The trade-off is that a flood of frames with forged or random source MACs can overflow the table and degrade the switch (a MAC-flooding attack), which is why managed switches can limit learned addresses per port.