MAC address learning

Start with three hosts and an empty table

Ethernet switchingIllustrative topology

Use the independent VLAN 10 access-port baseline below. All three hosts are up and correctly addressed. Use their actual MAC values if they differ. No security filtering, unknown-unicast suppression or blocked spanning-tree ports is assumed. Host firewalls must permit the chosen test.

configure terminal
vlan 10
 name LAB
interface range GigabitEthernet1/0/1 - 3
 switchport mode access
 switchport access vlan 10
 no shutdown
end

Clear only this isolated lab VLAN. The operation removes dynamic forwarding entries, not host ARP caches, static entries or VLAN membership. Background traffic can repopulate the table immediately.

SW1#clear mac address-table dynamic vlan 10

SW1#show mac address-table dynamic vlan 10
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
Total Mac Addresses for this criterion: 0

First frame: learn the source, look up the destination

Consider a unicast frame from H1 to H2, with H1 already knowing H2’s MAC address. It arrives on Gi1/0/1. SW1 records source 0200.0000.0011 in VLAN 10 on that ingress interface. It then searches for destination 0200.0000.0012. There is no entry yet.

Both H2 and H3 receive a copy in this simplified lab. H2 is the addressed receiver; H3 normally rejects a unicast addressed to another host at its interface. The switch does not turn the destination into a broadcast address. Flooding replicates the original frame.

Reply: learn H2, then use the table

When H2 sends a reply, SW1 learns source 0200.0000.0012 on Gi1/0/2. H1 is already known on Gi1/0/1, so SW1 forwards that reply only there. Subsequent H1→H2 unicast can use Gi1/0/2 directly.

SW1#show mac address-table dynamic vlan 10
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    0200.0000.0011    DYNAMIC     Gi1/0/1
  10    0200.0000.0012    DYNAMIC     Gi1/0/2
Total Mac Addresses for this criterion: 2

No H3 entry is needed merely because H3 received a flooded copy. SW1 learns an address when that host transmits a frame through SW1, not by observing a destination address. A learned entry points toward the host; it need not identify a directly attached device when another switch sits behind that port.

Separate unknown unicast from broadcast

If H1 has no IPv4-to-MAC mapping for H2, its first packet exchange normally begins with an ARP request. The ARP request uses the broadcast destination; the reply is normally unicast. That initial broadcast can teach SW1 H1’s source, and the reply can teach H2’s source before the ICMP echo is sent. Do not assume every first ping demonstrates unknown-unicast flooding.

VLAN membership, spanning-tree state, isolation and policy can restrict the eligible set. Broadcast does not stop being broadcast once hosts have learned addresses. Multicast and reserved bridge-control frames have additional rules and are outside this experiment.

Generate traffic and distinguish the two tables

H1$ ping -c 3 10.10.10.12
3 packets transmitted, 3 received, 0% packet loss
H1$ ip neigh show 10.10.10.12
10.10.10.12 dev eth0 lladdr 02:00:00:00:00:12 REACHABLE

The host neighbor entry maps an IP destination to a link-layer address. SW1’s MAC table maps VLAN plus MAC address to an interface. These are different tables. A known host ARP entry can outlive a switch entry, so an apparently healthy IP mapping does not guarantee that SW1 currently knows the destination port.

In an authorized capture exercise, keep H1’s neighbor entry while clearing SW1’s dynamic VLAN entry, then generate one H1→H2 unicast and capture on H3 with an appropriate capture interface. Compare before and after H2 replies. Ordinary application receive logs may not expose frames rejected by H3’s NIC. No packet capture is claimed here.

Aging, movement and a missing entry

Dynamic entries age when they are not refreshed under the switch’s learning rules; the configured aging interval is platform-specific. A host that moves and transmits from another port can cause a new learned location. Repeated unexpected movement between ports is a symptom to investigate, including loops or duplicate identities.

SW1#clear mac address-table dynamic address 0200.0000.0012
SW1#show mac address-table address 0200.0000.0012
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
Total Mac Addresses for this criterion: 0

This targeted lab operation recreates a missing H2 entry; it is not a connectivity repair. Send traffic from H2 to H1 to refresh the source learning. Then confirm the expected location instead of adding a permanent entry as a workaround.

SW1#show mac address-table address 0200.0000.0012
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    0200.0000.0012    DYNAMIC     Gi1/0/2
Total Mac Addresses for this criterion: 1

SW1 can now select Gi1/0/2 for H2’s unicast address. Clearing dynamic entries alone should not be presented as fixing a VLAN, physical-link or host-policy fault.