Networking · Routing & Switching
Switching
Layer 2 forwarding of frames within a broadcast domain using learned MAC address tables.
FoundationalUpdated 2026-09-01
Overview
A switch learns the source MAC address of every frame it receives and associates it with the receiving port. Frames destined for a known address are forwarded to that port alone; unknown, broadcast and multicast frames are flooded within the VLAN.
Redundant switch links create loops, so spanning tree (or a modern equivalent such as MLAG or fabric protocols) blocks redundant paths until they are needed. Loop protection is the difference between a resilient campus and a broadcast storm.
How it works
- 01MAC tables age out entries, typically after five minutes, which is why an idle device can briefly cause flooding.
- 02Rapid spanning tree elects a root bridge and blocks non preferred paths; port roles change within seconds on failure.
- 03Link aggregation bundles ports into one logical link for bandwidth and resilience, using LACP for negotiation.
- 04Access ports carry a single untagged VLAN with PortFast and BPDU Guard; trunks carry tagged VLANs between infrastructure devices.
Security considerations
- Enable BPDU Guard on access ports so a rogue switch cannot become root.
- Enable port security or 802.1X to limit which devices can connect.
- Turn on DHCP snooping and dynamic ARP inspection to blunt on path attacks.
- Disable unused ports and remove them from data VLANs.
Common misconfigurations
- Deliberately setting the root bridge nowhere, leaving election to the lowest MAC address, often the oldest switch.
- Uplinks configured as access ports, silently collapsing VLANs together.
- Unmanaged switches added under desks, defeating segmentation and monitoring.