Switch Learning Vs. Switch Forwarding – Analysis

 In 200-301 V1 Ch05: Ethernet Switching, 200-301 V1 Part 2: Ethernet, CCENT-OLD, Q&A

In many ways, the #CCENT and #CCNA are all about practice. Yes, you need to learn, but you need to practice applying what you learned if you want to do well on the exams. Today’s post looks at the answers to a multi-choice question posed in an earlier post by breaking down the logic. If you have read at least 1/3rd of my ICND1 Cert Guide, you have all the required knowledge – now you just need to practice applying that knowledge. Think of this post as a breakdown of your practice session with this question.

Relevant Links:

Background Info

If you have not looked at the question yet… look here!

For easier reference, here’s a copy of the figure supplied with the question.

Figure 1: Diagram Used with this Question


Do not Spoil the Answer Here

For those of you who are already confident that you know the correct answer, great! For those of you who want some help… this post is for you.

I will post the correct answer a day or so later, in a separate post, just to avoid spoiling the answer. PLEASE DON’T LIST YOUR PREFERRED ANSWER ON THIS POST! Thanks.

Learning and the Control Plane

To answer this question, you have to be ready to apply the concepts of how switches learn MAC addresses. Why, when the question actually asks where the switch will forward a frame? Well, that’s because the switch makes it’s forwarding decision based on it’s current MAC address table, and the current MAC address table is based on what happened before the frame in question arrived.

So, let me give you a short exercise to try when thinking about questions like this: questions that ask where a switch will forward a frame. Ask yourself about the switch’s MAC address table:

  • At the beginning of the question
  • After the first frame arrives and the switch learns from it
  • After the second frame arrives and the switch learns from it
  • And so on.

If you write down the contents of the MAC address table at each step, you will know the contents of the table at the point in time when the important frame arrives: the frame the question asks about.

Create MAC Tables for All Three Steps for this Question

Next, take the time to re-read the text of the original question, in light of the list above. Look for info about the contents of the table at the beginning of the scenario, and information about the frames that arrive during the scenario. In particular, for any frames that occur, watch for:

  1. The source MAC address of the frame
  2. The switch interface in which the frame will arrive
  3. The VLAN associated with the incoming interface (if an access interface)
  4. The VLAN tagged on the arriving frame (if a trunk interface)

This question basically tells you that the switch has an empty MAC address table to begin, and that two frames arrive. It also tells you that all ports are in VLAN 1.

Final Marching Orders: Fill Out These Tables!

To think it through, finally, just fill out these MAC address tables for the switch: One for the initial state, one for the state after receiving the first frame, and one for the state after receiving the second frame.

Table 1: MAC Table at Beginning of Scenario

MAC Address Port VLAN

Table 2: MAC Table after 1st Frame Arrives

MAC Address Port VLAN

Table 3: MAC Table after 2nd Frame Arrives

MAC Address Port VLAN


After filling out these tables, then ask yourself the question again.

Switch Learning Vs. Switch Forwarding Question
Switch Learning Vs. Switch Forwarding: Answer
Notify of

Newest Most Voted
Inline Feedbacks
View all comments

Dear Mr Odom,
First off, thanks for this blog. Its great. I have a question regarding my approach for questions that might refer t the expected contents of a MAC address table. In ch7 figure 7-4,
It shows SW1 and SW2 connected to each other via G0/1 on SW1 and GO/2 on SW2. SW1 has two PC’s, one on F0/1 and one on F0/2. SW2 has two PC’s one on F0/3 and one on F0/4.

As a result of this scenario, each switches MAC address table in the book shows 4 entries(two for the PC’s directly connected and two for the PC’s on the other switch.

My question is, when I duplicate this scenario in Packet Tracer, each table shows a fifth entry referencing the MAC address of the opposite switches Gigabit port.

Im just wondering how I should be thinking about this with regards to the CCENT1 exam.

Im not sure if it matters how I filled the tables, so I’ll just mention here that the tables where all empty and then I change the default PC adapters setting from static to DHCP and the tables populated.




Hi Nick,
Couple of thoughts.
First, on any simulator, I’d be a little careful to trust it for behavior that seems suspicious. HOWEVER, in this case, PT is acting like a real switch. The example in the book is ignoring the underlying point and explanation (on purpose).
The reason those entries show up has to do with overhead (aka control and management plane) protocols running on the two switches, like CDP and DTP. For example, with CDP, the switches will send Ethernet frames that encapsulate CDP messages (no IP header). Those Ethernet frames use multicast destination MAC addresses, but use the source MAC of the interface out which the frame is sent. As a result, the neighboring switch learns about the neighboring switch’s interface MAC address on that link.
I ignore those details in the book, as it distracts from the >>> more important topic at hand, and that’s how switches forward frames for other devices. Not that it’s bad to think about the rest of the story.
Experiment: create 3 links between the two switches, and see what other MACs your switches learn.


Thanks for your blog Mr. Odom¡
Carry out the experiment with the packet tracer and the Switch as well learn the consecutive MACs that the first link has:

SW1>show mac address-table dynamic
Mac Address Table

Vlan Mac Address Type Ports
—- ———– ——– —–

1 0001.975b.5016 DYNAMIC Fa0/21
1 0001.975b.5017 DYNAMIC Fa0/22
1 0001.975b.5018 DYNAMIC Fa0/23

Would love your thoughts, please comment.x