MAC Address – How to Trace on a Switched LAN

Switches don't use ARP to learn MAC addresses. Switches lean which MAC address is on which port simply by inspecting the source addresses on frames which come into the switch ports.

Switches don't understand layer-3 (except for layer-3 switches). To the switch, a router is just another host on the LAN.

All the above is from the perspective of layer-2 switch operation. A switch may have a management address, but, again, this is just another host on the LAN, and the management will use ARP and have a configured gateway and learn its MAC address with ARP, but it really has nothing to do with how the switching operates.

A host wishing to send an IP packet to another host will look in its ARP cache for the MAC address. If there isn't an entry in its ARP cache, it will send an ARP request to resolve the layer-3 IP address to the layer-2 MAC address. It will then build a layer-2 frame with this information and send it to the switch. If the destination IP address is on a different network, the host will look for the MAC address of its configured gateway in its ARP cache, and send an ARP request if it isn't in there, build a frame and send it out, just as it would for any other host.

As the frames come into the switch, the switch will look at the source MAC addresses, and use that to build its MAC address table, not the same as an ARP cache. When a switch receives a frame with a destination MAC address which isn't in its MAC address table, it will flood the frame out every port; it does not use ARP requests to discover this. It doesn't take a switch very long to build its MAC table since it take only one frame from each host to populate the MAC address table.

Good question. I'll answer it with an animation:

When Host A sends the frame, the switch does not have anything in its MAC address table. Upon receiving the frame, it records Host A's MAC Address to Switch Port mapping. Since it doesn't know where the destination MAC address is, it floods the frame out all ports.

This assures that if host B exists (which at this point, the switch does not know yet), that it will receive it. Hopefully, upon receiving the frame, Host B will generate a response frame, which will allow the Switch to learn the MAC address mapping from the return frame.

You can read more about how a Switch works here (where I took the animation from). I would also suggest reading the entire article series for a closer look at how a packet moves through a network.

One last note regarding the terms Flooding vs Broadcast. A switch never broadcasts frames, a broadcast is not an action a switch can take. A switch can only flood a frame. A broadcast is simply a frame with a destination MAC address of ffff.ffff.ffff. This is often confused because the end effect is the same, but they are actually different.