How a switch learns 11 min read
Ethernet, MAC Addresses, Switching, and LLDP
See what a switch actually reads, how it learns device locations, when it floods traffic, and how LLDP reveals neighboring equipment.
- Identify the important fields and purpose of an Ethernet frame.
- Explain how a switch builds and uses its MAC address table.
- Distinguish unicast, broadcast, and multicast destination behavior.
- Use LLDP information during documentation and troubleshooting.
The Ethernet envelope
An Ethernet frame wraps higher-layer information with source and destination MAC addresses, a type or length field, optional VLAN information, and an error-detection value. Switches primarily use the destination MAC address to decide where a frame should go.
A MAC address identifies a network interface at Layer 2. It is commonly written as six hexadecimal pairs. It is not the same as an IP address: MAC addresses support local Ethernet delivery, while IP addresses support logical addressing and routing.
A switch learns from source addresses
When a frame enters a port, the switch records the source MAC address and associates it with that port and VLAN. When a later frame is addressed to that MAC, the switch forwards it only toward the learned port.
If the destination is unknown, the switch floods the frame within that VLAN. Broadcast frames are also flooded within the VLAN. Learned entries age out, so a device that moves can eventually be relearned on a different port.
- Known unicast: forward toward the learned destination port.
- Unknown unicast: flood within the VLAN while the destination is unknown.
- Broadcast: deliver throughout the VLAN.
- Multicast: treatment depends on multicast configuration such as IGMP snooping.
LLDP is the neighbor introduction
LLDP stands for Link Layer Discovery Protocol. A device advertises facts about itself to its directly connected neighbor, potentially including system name, port identity, management address, capabilities, and power information.
LLDP does not discover the entire route across a network. It describes the device on the other end of a direct link. That makes it excellent for validating switch-to-switch uplinks, identifying an endpoint on a mystery port, and documenting what is actually connected.
Put it in an AV system.
Finding a mislabeled decoder
Look up the decoder's MAC address in the switch table, identify the learned port, and compare LLDP neighbor data and patching against the drawings.
Redundant Dante interfaces
Primary and secondary interfaces have different MAC addresses and must land on the intended isolated networks. The MAC table provides hard evidence of where each interface actually appears.
- MAC
- Media Access Control address; a Layer 2 interface identifier.
- Frame
- The unit of information transported by Ethernet.
- Flooding
- Forwarding a frame to multiple ports when required or when the destination is unknown.
- LLDP
- Link Layer Discovery Protocol; direct-neighbor advertisement.
- FCS
- Frame Check Sequence used to detect frame corruption.
Build a three-device map
Choose three AV endpoints. Record their MAC addresses, IP addresses, switch ports, and LLDP system names. Compare the result with the port labels and network drawing.
Three quick questions.
01What does a switch learn from an incoming Ethernet frame?
It learns the source MAC address and associates it with the incoming port and VLAN.
02What happens to an unknown unicast frame?
The switch normally floods it within the relevant VLAN until it learns the destination.
03Does LLDP show every device across the routed network?
No. LLDP describes directly connected neighbors at Layer 2.