Switch Forwarding and MAC Address Tables

Why the MAC table is the switch’s brain

HCIA-Datacom treats Ethernet switching as more than “plug cables and it works.” Exam items ask how a switch decides where a frame goes, what happens when the destination is unknown, and which VRP commands prove learning is healthy. The MAC address table (also called the CAM table) is the data structure that drives those decisions. Master learning, aging, and flooding, then the VLAN chapters that follow make sense: VLANs simply partition where those MAC lookups are allowed to apply.

A pure Layer 2 switch makes decisions with destination MAC addresses inside a broadcast domain (today, almost always a VLAN). It does not decrease TTL, look up IP routes, or rewrite Layer 3 headers. When you later configure VLANIF interfaces, the same chassis may also route—but that is a separate Layer 3 process after the frame is accepted for a local SVI MAC.

Frame arrival: the three classic outcomes

When a frame enters a switch port, the switch evaluates the destination MAC (and, on VLAN-aware devices, the VLAN context of that frame):

Flooding is intentional: Ethernet assumes the unknown host might sit behind any port in the segment. Flooding is also expensive—unknown unicast storms and large broadcast domains are why VLANs exist.

Source learning (how the table fills)

Learning is driven by the source MAC, not the destination:

1. Frame arrives on port G0/0/1 in VLAN 10.
2. Switch records: MAC SA → port G0/0/1, VLAN 10, with a dynamic age timer.
3. Later frames to that MAC in VLAN 10 go only to G0/0/1 (known unicast).

If the same MAC later appears as source on a different port, the entry moves (unless sticky/static policy forbids it). Host mobility, cable moves, and loops can churn the table—STP and later chapters address loop risk.

Aging

Dynamic entries are temporary. If a host goes silent longer than the aging time, the entry is deleted. The next frame to that MAC becomes unknown unicast and is flooded until the host transmits again and is re-learned. Aging keeps the table small and allows a host to move without remaining stuck on the old port forever.

On many Huawei campus switches the default aging time is on the order of 300 seconds, but you must treat the platform default as something to verify in lab, not memorize blindly for every model. What the exam cares about is the concept: silent hosts age out; active hosts refresh the timer each time they send.

MAC table entry types

Static entries do not age like dynamic ones. They are useful when you want a MAC to remain tied to a port even if the host is quiet—or to detect spoofing when a MAC appears on the wrong port (security features may shut the port). For HCIA, know that dynamic learning is default and static is explicit admin intent.

Modern switches maintain MAC entries per VLAN. The same MAC string can theoretically appear in different VLANs (rare on one host, common as concepts for multihomed designs). Always read display mac-address output with the VLAN column in mind.

Huawei VRP verification commands

Build muscle memory for these HCIA-relevant commands:

<Huawei> display mac-address
<Huawei> display mac-address dynamic
<Huawei> display mac-address GigabitEthernet0/0/1
<Huawei> display mac-address vlan 10
<Huawei> display mac-address summary

Useful operational patterns:

• display mac-address — full or filtered view of learned and static entries (MAC, VLAN, port, type).
• Filter by interface or VLAN when a user reports “can’t reach the server” and you need to see where the server MAC is learned.
• display mac-address summary — quick scale check (how many entries, pressure on table size).

Aging configuration (system view, exact knobs vary slightly by software train):

[Huawei] mac-address aging-time 300
[Huawei] display mac-address aging-time

Clearing for lab resets or after major topology moves (use carefully on production):

<Huawei> reset mac-address

or more selective forms such as clearing by VLAN or interface when supported. After a clear, expect a temporary rise in flooding until traffic re-learns the table.

Static binding sketch (syntax can include VLAN and port):

[Huawei] mac-address static 5489-98ab-cdef GigabitEthernet0/0/5 vlan 10

Always confirm with display mac-address that the type shows static and the port matches design.

Walk-through: two PCs on the same VLAN

1. PC-A (MAC A) and PC-B (MAC B) are both in VLAN 10 on the same switch.
2. PC-A ARPs for PC-B → destination MAC is broadcast → switch floods ARP in VLAN 10 → learns MAC A on PC-A’s access port.
3. PC-B replies unicast to MAC A → switch learns MAC B; forwards reply only to PC-A’s port.
4. Subsequent IP unicast between them is known unicast both ways—no flooding—until aging removes an entry.

If PC-B never speaks (only receives), some environments still learn B when B’s reply or other traffic appears. Pure one-way silent destinations can force periodic flooding of unknown unicast—another reason quiet IoT devices sometimes look “chatty” from a switch perspective when they finally receive traffic.

Exam traps and troubleshooting habits

• Confusing MAC tables with ARP tables. display mac-address is Layer 2 CAM; display arp is IP-to-MAC on Layer 3 interfaces. Both matter; they answer different questions.
• Assuming unknown unicast is dropped. It is flooded (within the VLAN), not discarded.
• Ignoring VLAN scope. A MAC learned in VLAN 10 does not authorize forwarding of that MAC for VLAN 20 frames.
• Expecting routers to learn every host MAC on a remote subnet. Routers care about next-hop MACs on connected links; remote hosts are reached by routing, not by CAM across the whole campus.
• Table full conditions. On stressed access switches, learning failures can cause unexpected flooding; capacity is an O&M topic, but the principle appears in advanced campus design discussions.

Quick lab checklist

1. Generate traffic between two hosts in one VLAN.
2. Run display mac-address vlan <id> and confirm both MACs and correct ports.
3. Shut a host, wait beyond aging (or clear MAC), generate traffic again, and watch re-learning.
4. Move a cable and observe the MAC port change (unless static/sticky locks it).

Link to the rest of this chapter

MAC learning and flooding always happen inside a VLAN’s broadcast domain. The next section defines VLANs and why you split domains. After that, access, trunk, and hybrid ports control which VLAN a frame belongs to when it enters or leaves the switch. Inter-VLAN routing then explains how IP connectivity works between those domains when Layer 2 isolation is intentional.