MAC Addresses, OUI, and Layer 2 Forwarding

What a MAC address is

A MAC address is a 48-bit Layer 2 identifier usually written in hexadecimal. Common display styles:

00:1A:2B:3C:4D:5E
00-1A-2B-3C-4D-5E
001a.2b3c.4d5e

The leading bits include vendor allocation information, often called OUI (organizationally unique identifier).

OUI, locally administered addresses, and multicast/broadcast

OUI prefix maps to an assigned vendor block.
Locally administered addresses can be manually set or randomized by software.
Unicast MAC targets one interface.
Multicast MAC targets a subscribed group.
Broadcast MAC ff:ff:ff:ff:ff:ff floods within VLAN scope.

A MAC address does not identify a person. It identifies an interface and may be virtualized or randomized.

How switches learn source MAC addresses

Switches learn from the source MAC of incoming frames and bind the entry to the ingress port and VLAN.

Frame arrives on a port in VLAN X.
Switch records source MAC -> port mapping in VLAN X table.
Destination lookup determines forwarding action.

Known unicast, unknown unicast, and broadcast forwarding

Frame type	Table state	Switch action
Known unicast	Destination MAC found	Forward only to learned port
Unknown unicast	Destination MAC not found	Flood within VLAN except ingress port
Broadcast	Special destination ff:ff:ff:ff:ff:ff	Flood within VLAN except ingress port

This behavior is VLAN-scoped. Flooding does not cross VLAN boundaries without Layer 3 processing.

VLAN-scoped tables, aging, and MAC movement

MAC tables are per VLAN context, not global across all VLANs.
Dynamic entries age out after inactivity.
MAC movement can occur during topology changes, virtualization, or endpoint moves.

Frequent movement can indicate normal mobility, but can also indicate loops or instability depending on pattern.

Why vendor lookup is helpful but limited

OUI lookup helps identify likely manufacturers, but local/admin-randomized addresses, VM platforms, and container networking can obscure physical-origin assumptions.

ARP relationship: ARP maps IPv4 addresses to MAC addresses on a local segment, which then drives Layer 2 forwarding decisions.

Useful Cisco verification commands

Switch table and interface checks

show mac address-table
show mac address-table dynamic
show mac address-table address <mac-address>
show interfaces status
show interfaces counters errors

Command output and formatting vary by platform family and software release.

Common troubleshooting cases

Unknown-unicast flooding because destination MAC aged out or never learned.
Endpoint moved to new port but stale assumptions remain in documentation.
High error counters causing one-way communication and inconsistent learning.
Broadcast storms from loops overwhelming normal forwarding behavior.

FAQ

Can a MAC address reliably identify a user device forever?

No. MAC addresses can be randomized, reassigned, virtualized, or moved.

Why is unknown unicast flooding normal sometimes?

If destination is not yet learned or entry aged out, flooding is expected until learning occurs.

Does one MAC entry apply to all VLANs?

No. MAC learning is VLAN-scoped.

Identify a vendor with the MAC Vendor Lookup tool

Use MAC Vendor Lookup and review Cisco Catalyst Switch Stacking for related switch operations.

Previous: IPv6 Addressing and Subnetting Explained Next: Cisco Catalyst Switch Stacking