Switch – How does a switch learn a switch table

Good question. I'll answer it with an animation:

When Host A sends the frame, the switch does not have anything in its MAC address table. Upon receiving the frame, it records Host A's MAC Address to Switch Port mapping. Since it doesn't know where the destination MAC address is, it floods the frame out all ports.

This assures that if host B exists (which at this point, the switch does not know yet), that it will receive it. Hopefully, upon receiving the frame, Host B will generate a response frame, which will allow the Switch to learn the MAC address mapping from the return frame.

You can read more about how a Switch works here (where I took the animation from). I would also suggest reading the entire article series for a closer look at how a packet moves through a network.

One last note regarding the terms Flooding vs Broadcast. A switch never broadcasts frames, a broadcast is not an action a switch can take. A switch can only flood a frame. A broadcast is simply a frame with a destination MAC address of ffff.ffff.ffff. This is often confused because the end effect is the same, but they are actually different.

ARP (Address Resolution Protocol) is used by a source host to resolve the layer-3 address of a destination host to that host's layer-2 address. An ARP request is broadcast on layer-2, asking, "Who has this layer-3 address?" The host with that layer-3 address will unicast back to the requesting host with its layer-2 address.

Hosts populate an ARP cache with layer-3 addresses which have been resolved to layer-2 addresses so that ARP is only used the first time a host wants to send something to another host. Entries in a host's ARP cache have a timeout, and they will be eventually be flushed if there is no activity for that entry.

A switch only floods an unknown unicast, and switches don't ask who has a certain MAC address. A switch will maintain a MAC address table, which relates a particular MAC address to a switch interface. A switch builds or updates this table every time a frame enters a switch interface. The switch will look at the layer-2 source address on a frame entering an interface, and it will add to, or update, its MAC address table with that address and interface.

A switch will also look in its MAC address table for the layer-2 destination address in the frame to find to which interface the frame should be switched. Only if the switch doesn't find the destination address in its MAC address table does it flood the frame to all other interfaces. Entries in a switch MAC address table have a timeout, and they will eventually be flushed if there is no activity for the MAC address.