Study Guide
Ethernet Switching and MAC Addresses
What a MAC address is, how a switch learns source addresses and forwards on destination addresses, and why unknown unicast flooding is normal.
Lesson 3.9 Networking Fundamentals
Every device on a local network connects through something that passes its data on. This lesson is about how that data is addressed within one network, and how the box in the middle works out where to send it without being told.
Stage: Think
Passing notes
Think it through
Twenty people share a large open-plan office and pass paper notes to one another. What must be written on every note so that it reaches the right person, and so that an answer can come back?
- Hint 1: What would the reader need to know in order to reply?
Show what happens
Two names: who the note is for, and who sent it. Data passed around a local network carries the same two labels.
Think it through
Show the answer
Answer: B. Try every desk until it is claimed.
Try every desk until the note is claimed, and remember where each reply came from. The box at the centre of a local network faces the same problem and solves it in the same way.
Stage: Explain
MAC addresses
Every network interface, whether it is for a cable or for Wi-Fi, has an identifying number called a MAC address. Think of it as a name badge worn by the interface. Data travelling within one local network is addressed to a badge, not to a person.
A conventional MAC address is 48 bits long and written in hexadecimal, such as 00:1A:2B:3C:4D:5E: six bytes, each written as two hex digits. The unit of data that carries these addresses on a local network is called a frame. Every frame has two MAC addresses on it: the source (who sent it) and the destination (who it is for).
A MAC address is usually set by the manufacturer, but it can also be chosen by the device, randomised for privacy or copied by someone else.
- Manufacturer part: in a manufacturer-assigned address, the first three bytes usually identify the manufacturer and the last three identify the individual interface.
- Broadcast MAC:
ff:ff:ff:ff:ff:ff, all 48 bits set to 1, means “every device on this local network”. - Locally administered addresses: the examples in these lessons start with
02, which sets the bit meaning “locally administered”. They are safe examples that cannot clash with real manufacturer addresses.
Think it through
Show the answer
Answer: C. Where to deliver, not who is there.
Where to deliver data on the local network, and nothing more: it is not proof of which device, or which person, is really there.
Because a MAC address can be changed in software, it identifies an interface for delivery; it does not prove which physical device, or which person, is really there. A name badge can be swapped.
Stage: Predict
Learn from the source, forward towards the destination
A switch is the box that the devices in one local network plug into. Each socket on it is called a port. Its job is to pass each frame to the right port, and it has to work out for itself which device is on which port. Nobody tells it.
Think it through
A switch starts with no idea which device is plugged into which port, and nobody tells it. Every frame it receives carries a source address and a destination address. How could it work out where each device is?
- Hint 1: Which of the two addresses tells it something about the port the frame came in on?
Show what happens
Each time a frame arrives, note its source address and the port it came in on: that device must be on that port. The caretaker below does the same with notes.
Picture a new school caretaker who delivers notes between rooms and starts with an empty notebook.
- Whenever a note is handed to him, he writes down who sent it and which room they were in. That is how the notebook fills up.
- To deliver the note, he looks up who it is for. If the name is in his notebook, he goes straight to that room.
- If the name is not in his notebook yet, he tries every room except the one the note came from. Only the right person keeps the note; everyone else hands it back.
A switch does exactly this. Its notebook is the MAC address table: a list of which MAC address was last seen on which port. Follow an empty switch as it learns three devices: Laptop A on port 1, Printer B on port 2 and Server C on port 3.
Check your understanding
Show the answer
Answer: A. Out of port 1 only.
Out of port 1 only, because it already knows where A is. It also learns that B is on port 2. The step-through follows four frames like this.
Four frames pass through a switch whose MAC address table starts empty. Each step shows what the switch learns, what it does with the frame and what its table then holds. The devices and addresses are illustrative.
Laptop A sends to Printer B
Step 1 of 4: Learn A, then flood
The frame arrives on port 1 with source A. The switch writes “A is on port 1”. It looks up the destination, B, and finds nothing, so it sends the frame out of ports 2 and 3. Printer B accepts it. Server C sees that it is addressed to someone else and discards it. The table now holds: A → port 1.
Printer B replies to Laptop A
Step 2 of 4: Learn B, then forward
The reply arrives on port 2 with source B. The switch writes “B is on port 2”. It looks up the destination, A, finds port 1 and sends the frame out of port 1 only. Server C sees nothing. The table now holds: A → port 1, B → port 2.
Laptop A sends to Printer B again
Step 3 of 4: Forward, with no flooding
The switch already knows A. It looks up B, finds port 2 and sends the frame out of port 2 only. The same message that had to be flooded in step 1 is now delivered to one port. The table is unchanged.
Server C sends to Laptop A
Step 4 of 4: Learn C, then forward
The frame arrives on port 3 with source C. The switch writes “C is on port 3”, looks up A and sends the frame out of port 1 only. The table now holds: A → port 1, B → port 2, C → port 3.
The switch read two different fields in every frame: the source address to learn, and the destination address to forward.
After those four frames, the table is complete:
| Learned source MAC | Physical port | Device |
|---|---|---|
02:00:00:00:00:10 | 1 | Laptop A |
02:00:00:00:00:20 | 2 | Printer B |
02:00:00:00:00:30 | 3 | Server C |
Check your understanding
Show the answer
Answer: B. Source to learn; destination to forward.
The source address to learn, and the destination address to forward.
Three things to take from the walk-through.
- Learning uses the source address; forwarding uses the destination address. They are different fields, read for different purposes.
- The switch needs nothing else. It does not look at IP addresses or port numbers to make this decision. In the layer model, this is Layer 2 work: delivery within one local network.
- The table is memory, not a register of who is allowed. An entry that is not refreshed is forgotten after a few minutes, and the switch simply learns it again.
Where the caretaker comparison stops. The caretaker would notice a stranger wearing a colleague’s badge. A switch cannot: it believes whatever source address arrives. That weakness is what MAC flooding exploits.
Stage: Predict
Unknown unicast is normal behaviour too
Step 1 has a name. A frame addressed to one device is a unicast frame. When the switch has not yet learned where that device is, the frame is an unknown unicast, and the switch floods it: it sends a copy out of every port except the one it arrived on.
Think it through
Show the answer
Answer: B. A flooded frame is still for one device.
A flooded frame is still addressed to one device; the others discard their copy. A broadcast is addressed to everyone, and everyone reads it.
Two points prevent a common confusion.
- Flooding is not broadcasting. The flooded frame is still addressed to one MAC address. The other devices receive a copy and throw it away. A broadcast frame is addressed to everyone, and everyone reads it.
- Flooding is not a fault. It happens whenever a device is new or has been quiet long enough for its entry to be forgotten, and it stops as soon as that device sends something. A little flooding is normal. A great deal of it, all the time, is worth investigating.
Go deeper Flooding on a switch that is divided into VLANs
A switch can be divided into several separate networks called VLANs, taught in Switch Ports, VLANs and 802.1Q Trunks. The switch then keeps its table per VLAN, and an unknown unicast is flooded only to the other ports in the VLAN it arrived on. The port a frame arrives on is called its ingress port.
Stage: Predict
Where MAC flooding fits
Think it through
A switch believes every source address it sees, and its table can hold only so many entries. How might someone abuse those two facts?
- Hint 1: What happens to a full notebook when new names keep arriving?
Because a switch learns from whatever source addresses arrive, and floods frames for destinations it has not learned, this normal behaviour can be abused. Sending many frames with fabricated source addresses can fill the MAC address table and increase flooding. That attack, MAC flooding, and the switch port security that limits it are taught in MAC Flooding and Port Security, the first lesson of Module 4.
Switches can show their MAC address table, and it answers a very practical question: which physical port is a device plugged into? Looking up a device’s MAC address in the table is a common way to trace a cable or find an unexpected device on the network.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Show the answer
Answer: A. Look it up in the MAC table to find its port.
Look its MAC address up in the switch’s MAC address table, which shows the port it was last seen on, and follow the cable from there.
Apply it
- Hint 1: When is an entry forgotten?
Show the answer
Answer: C. That is normal: new or quiet devices.
That is normal: devices that are new, or quiet long enough to be forgotten, are flooded to until they send something. A great deal of flooding, all the time, is what is worth investigating.
Apply it
Show the answer
Answer: B. It shows what was seen, not who may connect.
The table is memory: it records the port each source address was last seen on, and forgets entries that are not refreshed. Limiting which addresses may use a port is a separate control, taught in Module 4.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: A conventional Ethernet MAC address is 48 bits.; MAC addresses can be locally administered, randomised or spoofed.; ARP resolves IPv4 information for local link-layer delivery.
Ethernet MACs are conventionally 48 bits and are not guaranteed permanent or trustworthy. ARP connects Layer 3 IPv4 information to Layer 2 delivery, but ordinary ARP messages lack authentication and can be spoofed.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: It learns the laptop’s source MAC address on port 1 and forwards the frame to port 2, using the destination MAC address.
A switch learns source MAC addresses and associates them with the ports they arrive on, and forwards a frame for a known destination to the learned port. Learning uses the source address; forwarding uses the destination address. The printer is already known on port 2, so there is no reason to flood. A Layer 2 switch forwards on MAC addresses, not IP addresses or TCP port numbers, and sending every frame everywhere describes a hub.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: Flood the frame to eligible ports in that VLAN, because the destination has not been learned; this is normal switch behaviour.
When a destination MAC address is unknown, a switch may flood the unicast frame to eligible ports within the VLAN. This is part of normal operation: the server has simply not been learned yet. The frame keeps its unicast destination and stays within its VLAN. MAC flooding is different: fabricated source addresses exhaust the table and increase this kind of flooding.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Study and revision
Return to What Is a Network? or practise the MAC address and switching questions and cards through Networking & Protocols. They are learning-only.
Stage: Consolidate
What to remember
- Every frame carries a source and a destination MAC address, 48 bits written in hexadecimal.
- A MAC address identifies an interface for delivery; it can be changed, so it proves nothing about who is there.
- A switch learns from source addresses and forwards on destination addresses, using its MAC address table.
- An unknown unicast is flooded to every other port: that is normal, and it is not a broadcast.
- Believing every source address is the weakness that MAC flooding abuses.
Key terms
- MAC address (MAC: Media Access Control)
A link-layer address used for local frame delivery, conventionally 48 bits written in hexadecimal. It may be randomised or spoofed, so it is not proof of identity.
- Switch
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
- MAC address table
The table in which a switch records which MAC addresses it has learned on which ports, so that it can forward frames selectively.
Common misunderstandings
MAC addresses can be locally administered, randomised or spoofed. They identify an interface for delivery, not a trusted identity.
That describes a hub, an older and simpler device that repeats everything it receives to every port. A switch learns where each MAC address is and forwards a frame for a known device only towards it.
Flooding frames for not-yet-learned destinations is normal switch behaviour. Its cause and volume matter.
Lesson sources and acknowledgements
Sources and scope
This lesson develops the additional educational explanations from my Session 5 ChatGPT note-taking discussion alongside the approved Learning Log. The step-through and the table describe a simplified fictional switch, not a packet capture or verbatim tutor quotation, and no practical switch testing is claimed. MAC examples are locally administered unicast addresses, consistent with the existing learning visuals.
- Taught in Session 5 (see the Session 5 Learning Log): 48-bit hexadecimal MAC addresses that may be locally administered, randomised or spoofed; switches learning source MAC addresses and forwarding known destinations.
- Supplementary explanation: the name-badge and caretaker comparisons, the four-frame step-through, the parts of a MAC address, the distinction between flooding and broadcasting, the note on VLANs, the misunderstandings and the practical note. The step-through diagram is original.
- Moved to Module 4: the MAC flooding and port-security sections are now in MAC Flooding and Port Security, with their wording and anchors kept. The sections are listed below with links to their new home.
Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the note-passing opening questions, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
Communication sent to every device in the relevant broadcast domain. Routers do not normally forward ordinary local broadcasts.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
The unit of data at the Data Link layer, such as an Ethernet frame. It is addressed with MAC addresses for delivery across one local link.
A base-16 number system using the digits 0–9 and the letters A–F, where A = 10 and F = 15. One hexadecimal digit represents exactly four bits.
A logical network-layer address identifying an interface for delivery across networks. IPv4 addresses are 32 bits; IPv6 addresses are 128 bits.
A link-layer address used for local frame delivery, conventionally 48 bits written in hexadecimal. It may be randomised or spoofed, so it is not proof of identity.
The table in which a switch records which MAC addresses it has learned on which ports, so that it can forward frames selectively.
Sending frames with many different source MAC addresses to exhaust a switch’s MAC address table. This increases flooding of unknown unicast traffic within the VLAN.
A 16-bit logical number that identifies a service or endpoint for TCP or UDP. It is different from a physical switch port.
A switch feature that limits the number of MAC addresses learned on an access port, with a defined action when the limit is exceeded.
A software endpoint for network communication, managed by the operating system.
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
Communication sent to one intended recipient.
Sections now in other lessons
Earlier versions of this page included these sections. Each now has a fuller explanation in its own lesson.
- What MAC flooding changes now in MAC Flooding and Port Security
- Before and after: a deliberately tiny table now in MAC Flooding and Port Security
- Why the hub analogy has limits now in MAC Flooding and Port Security
- Cybersecurity implications now in MAC Flooding and Port Security
- Practical defensive controls now in MAC Flooding and Port Security
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.