How a Switch Forwards Frames

A switch is the modern device that connects devices in a LAN, and it is far smarter than a hub. Instead of blindly repeating data, a switch reads addresses and forwards each frame only to the port where the destination actually is. This single change dramatically improves speed, efficiency, and security. This lesson explains exactly how a switch makes those forwarding decisions.

A switch works at the data link layer (Layer 2 of the OSI model). At this layer, data is organized into frames, and each device has a unique MAC address (Media Access Control address) burned into its network card. The switch reads the MAC addresses inside frames to decide where to send them, which is why it is called a Layer 2 device.

Every Ethernet frame carries two MAC addresses: a source (who sent it) and a destination (who should receive it). The switch examines these addresses on each frame. By tracking which MAC address lives on which port, the switch can deliver frames precisely, instead of flooding them everywhere as a hub does.

A switch builds its knowledge by learning. When a frame arrives, the switch records the source MAC address and the port it came in on, storing that pair in its MAC address table. Over time, as devices send traffic, the switch learns where every device is. This automatic learning needs no configuration and happens continuously.

To forward a frame, the switch checks the destination MAC against its table:

• Known address — send the frame out only the matching port.
• Unknown address — flood it out all ports except the one it arrived on.

Once the destination replies, the switch learns its location too, so future frames go straight there.

When a switch does not yet know where a destination MAC lives, it floods the frame out every port except the source port, much like a hub. But this is temporary: as soon as the destination responds, the switch learns its port and stops flooding for that address. So flooding is a fallback, not the normal behavior, and the table fills in quickly.

Each switch port operates in full-duplex, sending and receiving at the same time, and gives the connected device its own dedicated bandwidth rather than a shared pipe. This eliminates the collisions that plagued hubs and lets every device run at full speed simultaneously. It is a key reason switched networks vastly outperform hub-based ones.

The MAC table does not grow forever. Each entry has an aging timer; if the switch hears nothing more from a MAC address for a set time, it removes that entry. This keeps the table current as devices move or disconnect. If a device later sends again, the switch simply relearns its location, keeping forwarding accurate.

Switches handle frame types differently:

• Unicast — to one device; forwarded to that one port if known.
• Broadcast — to all devices; sent out every port.
• Multicast — to a group; flooded or, with extra features, sent selectively.

Broadcasts always spread across the whole switch, a point that matters for broadcast domains later.

Switches can forward frames in different ways. Store-and-forward receives the entire frame, checks it for errors, then forwards it — accurate but slightly slower. Cut-through begins forwarding as soon as it reads the destination address — faster but it cannot catch errors. Most modern switches use store-and-forward for reliability. Knowing these two methods and their speed-versus-accuracy trade-off is useful for the exam.

By forwarding intelligently, switches deliver three big wins over hubs: better performance from dedicated full-duplex ports, fewer collisions because each port is its own collision domain, and improved security because frames are not sent to every device. These advantages are exactly why switches replaced hubs everywhere and form the backbone of every modern LAN.

Test your switching knowledge.

You learned that a switch is a Layer 2 device that reads MAC addresses in frames to forward them intelligently. It learns source MACs and their ports into a MAC address table, then forwards known destinations out a single port and floods unknown ones temporarily. Each port is full-duplex with dedicated bandwidth, eliminating collisions. Table entries age out to stay current. Switches outperform hubs in speed, collisions, and security, powering every modern LAN.