Review protocol layers, encapsulation, TCP, UDP, and ports.
MAC address learning and frame forwarding
A MAC address is a link-layer address. An Ethernet switch learns a frame’s source MAC address and the port it arrived on, within the relevant VLAN. When it knows the destination, it forwards toward the learned port. An unknown unicast is flooded to eligible ports in that VLAN, except the receiving port. Dynamic entries can age out.
ARP helps an IPv4 device find the link-layer address of a next hop on its local link. If the destination is on another subnet, a host normally asks for its default gateway’s MAC address. It does not ask the local switch to discover the remote server’s MAC across the internet.
ARP resolution example
A PC at 192.168.10.10/24 wants 192.168.20.20. Its route sends the packet to gateway 192.168.10.1. The Ethernet destination is the gateway’s MAC, while the IP destination remains 192.168.20.20. A router builds a new link-layer frame for the next link. NAT, when configured, can also change IP addressing.
Use show mac address-table on a switch and show ip arp on supported Cisco devices. On a Windows host, arp -a displays cached entries. A table entry is a learned observation, not proof of a person’s identity.
Verification commands
Use these viewing commands to inspect the idea in this lesson. Start in the environment shown above each example.
show mac address-table
show ip arpCommand reference · enter in the stated environment; output varies by device.
Practical exercise
With two PCs on one switch, inspect the MAC table before and after a ping. Which addresses are learned, and which ports do they use?
Show the answer and explanation
The switch learns each transmitting PC’s source MAC on its connected port. Initial ARP and ping traffic can create the entries. The exact table depends on traffic and aging.
QUICK KNOWLEDGE CHECK
Check your understanding
Related labs and exercises
Sources & content checks
Technical references checked on 25 October 2026. These are original teaching explanations, not official Cisco course material. See how content and lab validation are described.
Your progress
Mark this complete when you can explain the example and do the exercise.