What an Ethernet frame carries
An Ethernet frame carries a destination MAC address, a source MAC address, a type or length field, payload and a frame check sequence. An EtherType identifies what the payload carries, such as IPv4 or IPv6. The frame check sequence lets the receiver detect transmission errors.
IEEE 802.3 defines Ethernet on shared half-duplex media and on full-duplex links. Devices sharing a half-duplex medium use CSMA/CD to handle contention. On a full-duplex link between a host and a switch, both ends can transmit at the same time without collisions.
How a switch learns and forwards
A switch learns from the source MAC address of an incoming frame. It records the source address and ingress port in its forwarding table for that VLAN. It then looks up the destination address in the same VLAN. A known unicast destination can be sent to its learned port. If that port is also the ingress port, the switch filters the frame.
When the destination is unknown, the switch floods the unicast frame to the other eligible forwarding ports in the VLAN. Traffic from the destination host lets the switch learn that host’s port for later frames. Dynamic entries age out if the switch stops hearing from the source.
Try it in a lab
- In a practice lab, connect two hosts to switch access ports in the same VLAN. Give the hosts 192.0.2.10/24 and 192.0.2.20/24 and inspect the switch’s learned MAC addresses for that VLAN.
- Ping the second host from the first. After the reply, check that the switch has learned each host’s MAC address on its own port. If the sender has no ARP entry for the peer, a capture will show a broadcast ARP request before the unicast ICMP exchange.
- Move the second host to another access port in the same VLAN and send traffic from it. Look up its MAC address again. The table should now associate it with the new port.