A MAC address table is the database inside an Ethernet switch that maps each learned MAC address and VLAN to the port behind which that device sits. In Ethernet & switching, it is the mechanism that lets a switch forward a frame only to the port that needs it instead of repeating it everywhere, which is what separates a switch from an old hub.
The table is often called the CAM table, after the content-addressable memory that many switches use to search it at line rate. It is built automatically by observing traffic, kept current by an aging timer, and consulted for every frame the switch receives.
How a switch learns and uses MAC addresses
A switch fills its table through source address learning. Whenever a frame arrives, the switch reads the source MAC address and records it together with the incoming port and VLAN. If the address is already known on a different port, the entry is moved, because the device has evidently changed location.
Forwarding uses the destination MAC address. The switch looks it up in the table for the frame’s VLAN and then takes one of three actions, summarized below. This simple logic, often described as learn, flood, forward and filter, needs no configuration and works the moment a switch is powered on.
| Destination lookup result | Switch action | Effect |
|---|---|---|
| Known unicast, different port | Forward to that one port | Efficient, private delivery |
| Known unicast, same port | Filter, drop the frame | Prevents useless echo |
| Unknown unicast | Flood to all ports in the VLAN except the source | Reaches the device, which then gets learned |
| Broadcast | Flood to all ports in the VLAN except the source | Required for ARP and DHCP |
| Multicast | Flood, or forward per IGMP snooping state | Limits streams to interested ports |
Structure of a MAC address table entry
Each entry is keyed on the pair of VLAN ID and MAC address, not the MAC address alone. The same device can therefore appear in several VLANs with different ports, and each VLAN behaves as a separate forwarding domain, consistent with its role as a broadcast domain.
| Field | Example value | Purpose |
|---|---|---|
| VLAN ID | 20 | Separates forwarding per VLAN |
| MAC address | 00:1a:2b:3c:4d:5e | Identifies the device’s interface |
| Port | GigabitEthernet1/0/14 | Where frames for this address go |
| Entry type | Dynamic, static or secure | How the entry was created and kept |
| Age | Seconds since last seen | Used by the aging process |
Dynamic entries are learned automatically and expire. Static entries are configured by an administrator and never age out, which suits critical devices such as gateways. Secure or sticky entries are created by port security features that limit which addresses a port accepts.
Aging time, table size and other key parameters
The aging time removes entries for devices that have gone silent, freeing space and allowing moved devices to be relearned. The common default is 300 seconds, and most switches accept values from about 10 seconds up to several hours. During a spanning tree topology change, many switches temporarily shorten aging to the forward delay, typically 15 seconds, so stale paths disappear quickly.
| Parameter | Typical range | What it affects |
|---|---|---|
| Aging time | Default 300 s, adjustable from seconds to hours | Speed of cleanup versus flooding after expiry |
| Table capacity | A few thousand to several hundred thousand entries | How many devices a switch can track |
| Lookup speed | One lookup per frame at line rate | Throughput without software involvement |
| MAC limit per port | 1 to hundreds, configurable | Protection against flooding attacks |
Capacity matters most in data centers and virtualized environments, where each physical port may carry hundreds of virtual machine addresses. When the table is full, new addresses cannot be learned and their traffic is flooded like unknown unicast, which wastes bandwidth and exposes frames to every port.
MAC address table compared with related tables
The MAC address table is one of several lookup structures in a network device, and each answers a different question at a different layer. Confusing them is a common source of troubleshooting errors.
| Table | Maps | Layer | Built by |
|---|---|---|---|
| MAC address table | MAC and VLAN to port | Layer 2 | Source address learning |
| ARP table | IPv4 address to MAC address | Between Layer 3 and Layer 2 | ARP requests and replies |
| IPv6 neighbor cache | IPv6 address to MAC address | Between Layer 3 and Layer 2 | Neighbor discovery |
| Routing table | IP prefix to next hop | Layer 3 | Static routes and routing protocols |
A Layer 3 switch uses all of them together: the routing table chooses the next hop, the ARP table resolves its MAC address, and the MAC address table selects the egress port.
Security risks and troubleshooting
Because learning is automatic and trusts any source address, the table is an attack surface. In a MAC flooding attack, a host sends frames with thousands of random source addresses until the table overflows; the switch then floods traffic, letting the attacker capture frames meant for others. Port security limits and per-port MAC caps are the standard defense.
- MAC flapping: one address appearing alternately on two ports usually signals a loop or a misconfigured link aggregation.
- Intermittent connectivity after a move: a stale entry persists until aging or a new frame updates it.
- Asymmetric routing floods: when a device sends but rarely receives on a path, its entry ages out and return traffic floods.
- Locating a device: looking up a MAC address in the table and following uplinks traces it to the exact access port.
Explained without jargon
A network switch is like a receptionist in an office building. A MAC address table is the receptionist’s list of who sits in which room. Each time someone sends a message, the receptionist notes which door it came from. Later, messages for that person go only to that door.
If a name is not on the list yet, the receptionist asks every room once. After that, the list is updated. Names that have not been seen for a while are crossed off automatically, so the list stays current.
A typical use case
A school’s help desk receives complaints that a classroom printer keeps disappearing from the network. The network technician looks up the printer’s MAC address in the core switch’s table and sees it alternating between two ports several times per minute, a pattern known as MAC flapping.
Tracing the ports reveals that a teacher connected a small unmanaged switch to two wall outlets, creating a loop between two access ports. The technician removes the second cable, enables spanning tree protection on the access ports and sets a limit of three learned addresses per classroom port.
The table stabilizes immediately, the printer stays reachable on one port, and any future loop of the same kind now shuts the offending port down instead of disrupting the whole floor.