A switch examines destination Media Access Control (MAC) addresses and uses a filtering database to select the appropriate outbound port. It can learn the location of devices from source addresses observed on incoming frames rather than requiring every forwarding entry to be configured manually.
Frames for known destinations can be forwarded selectively, while broadcast, relevant multicast, and unknown-destination traffic may be replicated to multiple ports within the applicable broadcast domain. Bridges also need loop-control mechanisms because redundant Layer 2 paths can otherwise circulate and multiply frames. IEEE 802.1Q specifies bridge and virtual local-area network (VLAN) behavior and related traffic-class functions.
Key points
Learning and agingDynamic forwarding entries reflect recent source-address observations and expire over time; static entries and controls can override or constrain learning.
Forwarding scopeVLANs create distinct Layer 2 broadcast domains on shared switching infrastructure, while trunks can carry traffic for multiple VLANs between configured devices.
Security designProtect switch management, restrict unused ports and trunk formation, control Layer 2 protocols, and combine switching with authenticated admission, filtering, routing, and monitoring appropriate to the risk.
Important limitationA switch or VLAN is not automatically a trustworthy security boundary. MAC addresses can be spoofed, configuration can leak traffic between intended zones, and attacks or faults can disrupt address learning and loop control.