A network switch isn't just a passive connector. It's an active decision-maker that learns the layout of its local network. Its entire operation hinges on a single goal: to send data only where it needs to go. To do this, it has to understand the language of the local network, which is the Ethernet frame.

Every piece of data sent across an Ethernet network is wrapped in a frame. Think of it like an envelope for your data. The most important parts for a switch are the destination and source addresses written on the outside. These aren't IP addresses, which are for routing across different networks. These are Media Access Control (MAC) addresses, unique hardware identifiers burned into every network device.

When a switch boots up, it knows nothing about the devices connected to its ports. Its brain, the MAC address table, is empty. It populates this table by eavesdropping on the traffic that passes through it. This process is called learning.

Here’s how it works:

1. A computer (PC-A) sends a frame to another computer (PC-B).
2. The frame enters the switch on a specific port, say Port 1.
3. The switch reads the source MAC address from the frame's header (PC-A's MAC).
4. It adds an entry to its MAC address table, associating PC-A's MAC with Port 1.

Every time a device sends a frame, the switch learns or refreshes its location. This table is the switch's map of the local network.

Once the switch has learned from the source address, it must decide where to send the frame. It does this by looking at the destination MAC address in the frame's header.

The switch checks its MAC address table for this destination address. There are two main possibilities:

• Known Unicast: If the destination MAC is in the table, the switch knows exactly which port the recipient is on. It forwards the frame only to that specific port. No other devices on other ports see the traffic. This is what makes a switch intelligent and efficient.

• Unknown Unicast: If the destination MAC is not in the table, the switch doesn't know where to send the frame. So, it reverts to a simple strategy: it sends a copy of the frame out of every port except the one it came in on. This is called flooding.

There's a special case for flooding. If the destination MAC address is FF:FF:FF:FF:FF:FF, it's a broadcast frame. This is intended for every device on the network, so the switch will always flood it. This process is essential for protocols like ARP (Address Resolution Protocol) to work. However, excessive broadcast flooding can bog down a network.

Older network devices like hubs operated in half-duplex mode. This meant a device could either send or receive data at one time, but not both, like a walkie-talkie. If two devices tried to send at once, a collision occurred, corrupting the data and forcing both to back off and try again.

Switches changed the game by enabling full-duplex communication. Because each port on a switch is an isolated collision domain, a connected device can send and receive data simultaneously without any fear of collisions. It’s like having a two-lane private road for every device instead of a single-lane shared street.

Modern switches also keep detailed statistics for each of their interfaces. Network administrators can check a port to see how many frames have been sent and received, and more importantly, how many errors have occurred. They count things like CRC errors (frames corrupted in transit), runts (frames that are too small), and giants (frames that are too large). This error counting is a vital tool for troubleshooting physical connection problems, like a bad cable or a faulty network card.

Time to check your understanding of how a switch thinks.

By understanding the logic of learning on source MACs and forwarding on destination MACs, you grasp the fundamental process that makes local networks fast and efficient.