1Configuring the MAC address tableOverviewAn Ethernet device uses a MAC address table to forward frames. A MAC address entry includes adestination MAC address, an outgoing interface, and a VLAN ID. When the device receives a frame,it uses the destination MAC address of the frame to look for a match in the MAC address table.• The device forwards the frame out of the outgoing interface in the matching entry if a match isfound.• The device floods the frame in the VLAN of the frame if no match is found.How a MAC address entry is createdThe entries in the MAC address table include entries automatically learned by the device and entriesmanually added.MAC address learningThe device can automatically populate its MAC address table by learning the source MAC addressesof incoming frames on each interface.When a frame arrives at an interface (for example, port A), the device performs the following tasks:1. Checks the source MAC address (for example, MAC-SOURCE) of the frame.2. Looks up the source MAC address in the MAC address table.{ The device updates the entry if an entry is found.{ The device adds an entry for MAC-SOURCE and port A if no entry is found.3. When the device receives a frame destined for MAC-SOURCE after learning this source MACaddress, the device performs the following tasks:a. Finds the MAC-SOURCE entry in the MAC address table.b. Forwards the frame out of port A.The device performs the learning process each time it receives a frame with an unknown sourceMAC address until the table is fully populated.Manually configuring MAC address entriesDynamic MAC address learning does not distinguish between illegitimate and legitimate frames,which can invite security hazards. When Host A is connected to port A, a MAC address entry will belearned for the MAC address of Host A (for example, MAC A). When an illegal user sends frameswith MAC A as the source MAC address to port B, the device performs the following tasks:1. Learns a new MAC address entry with port B as the outgoing interface and overwrites the oldentry for MAC A.2. Forwards frames destined for MAC A out of port B to the illegal user.As a result, the illegal user obtains the data of Host A. To improve the security for Host A, manuallyconfigure a static entry to bind Host A to port A. Then, the frames destined for Host A are always sentout of port A. Other hosts using the forged MAC address of Host A cannot obtain the frames destinedfor Host A.Types of MAC address entriesA MAC address table can contain the following types of entries:
