What is the role of MAC address table in switches?

The MAC address table (also called CAM table — Content Addressable Memory) is the switch's database of which MAC addresses are reachable via which ports.

How It's Built

1. Frame arrives on a port with source MAC "AA:BB:CC:DD:EE:FF"
2. Switch records: MAC "AA:BB:..." is on port X, VLAN Y
3. When traffic destined for that MAC arrives, forward only to port X
4. Unknown destination → flood to all ports in VLAN

Entry Types

• Dynamic: Learned from traffic, aged out (default 300s)
• Static: Manually configured, never age out
• Sticky: Learned dynamically, saved to config (port security)

Table Size Matters

Switch specifications list "MAC table size" (e.g., 8K, 16K, 32K entries). If exceeded:

• New MACs cause older entries to be evicted
• Excessive flooding as MACs are unknown
• Performance degrades

MAC Flooding Attack

Attackers can spoof many random MACs to fill the table, forcing the switch to flood traffic — enabling packet sniffing. Mitigate with port security (limit MACs per port).

Aging

• Default: 300 seconds (5 minutes)
• Can be tuned per VLAN
• Too short: unnecessary flooding
• Too long: stale entries waste memory

Viewing the Table

• show mac address-table (Cisco style)
• Filter by VLAN, port, or MAC
• Useful for troubleshooting connectivity

Related Features

• Port security (limit MACs per port)
• MAC-based VLAN assignment
• MAC-based access lists
• DHCP snooping binding validation