An Ethernet switch is fundamentally a MAC-address-table machine. Every forwarding decision reduces to one lookup: which port did I learn this destination MAC on? Everything else — VLANs, trunks, spanning tree — exists to control the scope and safety of that lookup.
The three actions: learn, forward, flood
For every frame received, the switch does two independent things. First, it learns: the frame's source MAC address is recorded in the MAC address table (CAM table) against the ingress port and VLAN, with an ageing timer — 300 seconds by default on Cisco switches. Second, it forwards: the destination MAC is looked up in the same table. A hit means the frame is sent out exactly one port (or dropped, if that port is the port it came in on). A miss — an unknown unicast — means the switch floods the frame out every port in the same VLAN except the ingress port.
Broadcasts (ff:ff:ff:ff:ff:ff) are always flooded, which is precisely what ARP relies on: the ARP request reaches every host in the subnet because the switch floods it, and the ARP reply is unicast straight back because the switch has already learned the requester's MAC.
Switch# show mac address-table dynamicVlan Mac Address Type Ports 10 0050.56be.1a2b DYNAMIC Gi1/0/3 10 d46d.50aa.0102 DYNAMIC Gi1/0/24 20 0050.56be.9c4d DYNAMIC Gi1/0/7
VLANs: slicing the broadcast domain
A VLAN is a broadcast domain implemented in switch software. Ports assigned to VLAN 10 flood and learn only within VLAN 10; hosts in VLAN 20 on the same physical switch are as unreachable at layer 2 as if they were on a different device. Traffic between VLANs must be routed at layer 3 — by a router-on-a-stick or, in any modern network, a layer-3 switch with switched virtual interfaces (SVIs).
VLANs give you three wins: smaller failure and flood domains, logical grouping independent of physical location, and a security boundary that a misbehaving host cannot cross without routing.
Trunks and 802.1Q tagging
A trunk carries multiple VLANs between switches over one physical link. IEEE 802.1Q inserts a 4-byte tag into the Ethernet header containing a 12-bit VLAN ID (1–4094) and a 3-bit priority field used by QoS. One VLAN per trunk — the native VLAN — is carried untagged; both ends must agree on it, and best practice is to set the native VLAN to an unused ID and never carry user traffic on it.
Switch(config)# interface gi1/0/48Switch(config-if)# switchport mode trunkSwitch(config-if)# switchport trunk native vlan 999Switch(config-if)# switchport trunk allowed vlan 10,20,30
What to check when layer 2 breaks
- show mac address-table — is the destination MAC learned, on the port you expect, in the right VLAN?
- show interfaces trunk — is the VLAN allowed and forwarding on the trunk, and do native VLANs match?
- show interfaces status — right VLAN assignment, no err-disabled ports?
- Excessive flooding — has the MAC table overflowed (a security attack vector that port security addresses), or is asymmetric routing making entries age out?
Every layer-2 mechanism in this book — spanning tree, EtherChannel, port security — is a control wrapped around this learn/forward/flood engine. Know the engine and the controls make sense; skip it and they read as arbitrary rules.