Study guide
5.4 MAC Address Table Learning, Aging, and Forwarding
HPE Aruba Networking Certified Associate - Campus Access HPE6-A85
Track your progress as you read
Finished sections get a check mark.
1 Introduction: HPE6-A85 Exam Overview
HPE6-A85 Exam Facts and Current Blueprint
2 Chapter 1: Network Stack Fundamentals
1.1 OSI Reference Model and Encapsulation 1.2 TCP/IP Protocol Suite and IP Headers 1.3 Layer 2 Operation, ARP, and 802.1Q Tagging
3 Chapter 2: Physical Connectivity and Host Addressing
2.1 Ethernet Media and Transceiver Standards 2.2 Power over Ethernet (PoE, PoE+, PoE++) Standards and Budgeting 2.3 LLDP, LLDP-MED, and Voice VLAN Configuration 2.4 Host IP Addressing and DHCP Relay Operations
4 Chapter 3: Network Resiliency and Virtualization
3.1 Virtual Switching Framework (VSF) Architecture and Topologies 3.2 VSF Split Detection, Failover, and Auto-Stacking 3.3 Virtual Switching Extension (VSX) Architecture and Operations 3.4 High-Availability Gateways: VRRP and VSX Active-Gateway
5 Chapter 4: AOS-CX Architecture and Switch Operation
4.1 AOS-CX Hardware Portfolio and State Database Architecture 4.2 Network Analytics Engine (NAE) and Automated Telemetry 4.3 AOS-CX Interface Configuration and Port Control 4.4 Link Aggregation (LAG) and LACP Configuration
6 Chapter 5: Layer 2 Protocols and Spanning Tree
5.1 AOS-CX VLAN Configuration and Native VLAN Handling 5.2 Spanning Tree Protocols: STP, RSTP, and MSTP 5.3 Spanning Tree Protections and Loop Prevention 5.4 MAC Address Table Learning, Aging, and Forwarding
7 Chapter 6: Wireless Fundamentals, Standards, and RF
6.1 IEEE 802.11 Standards and Wi-Fi Generations 6.2 RF Fundamentals, Signal Propagation, and Channel Design 6.3 Aruba Access Point Hardware Portfolio and Suffix Conventions 6.4 WLAN Topologies, BSSID/ESSID, and Roaming Standards
8 Chapter 7: Aruba Wireless Architecture and Management
7.1 AOS 10 Architecture and Aruba Central Integration 7.2 Wireless Forwarding Modes: Bridge vs Tunnel Mode 7.3 Automated RF and Client Optimization: AirMatch and ClientMatch 7.4 Secure Wireless Access: WPA3, SAE, and MPSK Implementation
9 Chapter 8: IP Routing Fundamentals and OSPF
8.1 IP Routing Principles and Packet Forwarding 8.2 OSPFv2 Protocol Mechanics and Adjacency Formation 8.3 OSPF Designated Routers and Multi-Area Deployments 8.4 ECMP, Static Routing, and VRF Isolation
10 Chapter 9: Campus Network Security and Segmentation
9.1 DHCP Snooping and Dynamic ARP Inspection 9.2 Port Security and MAC Address Limiting 9.3 ClearPass Policy Management and RADIUS Change of Authorization 9.4 Dynamic Segmentation, User-Based Tunneling, and Policy Enforcement
11 Chapter 10: Authentication, Authorization, and Accounting
10.1 The AAA Framework and Architecture 10.2 802.1X Authentication and EAP Methods 10.3 MAC Authentication and Captive Portal Onboarding 10.4 Administrative Access Control: RADIUS vs TACACS+
12 Chapter 11: Network Management and Telemetry
11.1 Aruba Central Cloud Architecture and Group Configuration 11.2 Zero-Touch Provisioning (ZTP) and Aruba Activate 11.3 AI Insights and Aruba User Experience Insight (UXI) 11.4 Network Telemetry, Streaming APIs, and SNMP/Syslog
13 Chapter 12: Troubleshooting the Solution
12.1 Structured Troubleshooting Methodologies and Scope Isolation 12.2 AOS-CX Layer 2 and Interface Diagnostic Commands 12.3 Layer 3, IP Services, and End-to-End Diagnostics 12.4 Physical-Layer Troubleshooting 12.5 Troubleshooting Wireless Clients and Network Access
14 Chapter 13: Optimizing Performance: QoS, Baselines, and Comparisons
13.1 Quality of Service (QoS) Classification and Marking 13.2 Queuing Algorithms and Congestion Management 13.3 Traffic Policing, Shaping, and Broadcast Rate Limiting 13.4 Establishing a Performance Baseline 13.5 Comparing Results to the Baseline
15 Chapter 14: Plan the Solution
14.1 Analyzing the Current Environment 14.2 Interpreting an Architect's High-Level Design 14.3 Creating a Low-Level Design 14.4 Preparing for Implementation
16 Chapter 15: Validate and Operate the Solution
15.1 Validating the Solution 15.2 Performing Firmware Updates 15.3 Making Basic Ongoing Configuration Changes 15.4 Maintaining Network Documentation
5.4 MAC Address Table Learning, Aging, and Forwarding
Key Takeaways Explain This Topic AI
Layer 2 switches maintain a MAC address table (CAM table) that maps dynamic host MAC addresses and VLAN memberships to specific physical switch interfaces.
Switch learning is governed exclusively by the Source MAC address of ingress frames, whereas forwarding decisions are determined exclusively by the Destination MAC address.
When the destination MAC is absent from the MAC table, the switch performs unknown unicast flooding, replicating the frame out all ports in the same VLAN except the ingress port.
The default dynamic MAC aging timer on AOS-CX switches is 300 seconds; entries refresh upon receiving new frames from the host and age out during periods of inactivity.
MAC address flapping—where a MAC rapidly moves between different switch ports—is a key symptom of Layer 2 loops, duplicate host MACs, or virtual machine NIC teaming misconfigurations.
Last updated: October 2026
MAC Address Table Learning, Aging, and Forwarding
Quick Summary: At the heart of Layer 2 campus switching is the MAC Address Table (historically termed the Content Addressable Memory or CAM table). While legacy network hubs blindly repeated electrical signals across every port, modern switches make intelligent, hardware-accelerated forwarding decisions at wire speed. An AOS-CX switch autonomously builds its MAC table by observing the Source MAC address of incoming frames and associating it with the ingress port and VLAN. When forwarding frames, the switch looks up the Destination MAC address : if known, the frame is switched directly to the destination port; if unknown, broadcast, or multicast, the frame is flooded across the originating VLAN. Understanding table aging, static entries, and MAC address flapping is essential for enterprise access layer troubleshooting.
The Function and Architecture of the MAC Address Table
A Layer 2 Ethernet switch acts as a multi-port bridge, providing dedicated bandwidth to each connected endpoint and isolating collision domains. To accomplish this, the switch maintains an internal database mapping physical MAC addresses to local switch interfaces.
In AOS-CX switches, this database is implemented in hardware lookup tables, traditionally described as Content Addressable Memory (CAM) . Unlike conventional RAM, where a system supplies a memory address to retrieve stored data, CAM accepts the search query (the 48-bit MAC address and 12-bit VLAN ID) and returns the corresponding egress physical interface in a single clock cycle (nanosecond latency).
Each entry in the AOS-CX MAC address table contains four core attributes:
VLAN ID: The specific broadcast domain in which the MAC address was learned.
MAC Address: The 48-bit hardware address of the connected network interface (AOS-CX displays and accepts the xx:xx:xx:xx:xx:xx format).
Type: Indicates how the entry was established— Dynamic (learned automatically from incoming traffic) or Static (manually configured by an administrator).
Port / Interface: The physical interface (e.g., 1/1/5 ), Link Aggregation Group (e.g., lag1 ), or internal virtual interface associated with the device.
The Dynamic Learning Process: Source MAC Processing
When an AOS-CX switch powers on, its MAC address table is completely empty. The switch populates its forwarding table through an autonomous, four-step dynamic learning algorithm: +-----------------------------------------------------------------------------------------+
- | DYNAMIC MAC LEARNING FLOW |
- | |
- | Host A [MAC: 00:50:56:aa:11:11] -> Port 1/1/1 (VLAN 10) -----> AOS-CX Switch |
- | |
- | Step 1: Frame arrives on Port 1/1/1 in VLAN 10. |
- | Step 2: Switch inspects the SOURCE MAC address (00:50:56:aa:11:11). |
- | Step 3: Switch checks CAM table for [VLAN 10 + 00:50:56:aa:11:11]: |
- | - If absent: Creates new entry -> [VLAN 10, 00:50:56:aa:11:11, Port 1/1/1]. |
- | - If present on same port: Resets 300-second aging timer to zero. |
- | - If present on DIFFERENT port: Updates entry immediately (Host moved). |
- +-----------------------------------------------------------------------------------------+
- Critical Principle of Switch Learning
Exam Fundamental: A Layer 2 switch learns MAC addresses strictly from the Source MAC address of incoming frames. It never learns an endpoint's location from the Destination MAC address. Every frame received on an active port provides real-time verification of where that transmitting host is physically located.
Frame Forwarding Decisions: Destination MAC Processing
While learning is governed strictly by the Source MAC, forwarding decisions are governed strictly by the Destination MAC address and the frame's VLAN membership.
When a frame arrives, the switch ASIC evaluates the Destination MAC against its CAM table, executing one of three distinct actions:
1. Known Unicast Forwarding (Point-to-Point Switching)
Condition: The Destination MAC is a unicast address (least significant bit of the first byte is 0 ), and an active entry for that MAC and VLAN exists in the MAC address table.
Action: The switch forwards the frame strictly out the single designated egress port . No other interfaces receive the frame, ensuring complete privacy and conserving link bandwidth.
2. Unknown Unicast Flooding
Condition: The Destination MAC is a unicast address, but the switch has no recorded entry for that MAC address in the target VLAN.
Action: Because the switch does not know which physical port hosts the destination device, it performs unknown unicast flooding . The switch replicates the frame and transmits a copy out every active port belonging to that VLAN, except the ingress port on which the frame arrived.
Learning Response: When the destination host receives the flooded frame and sends a reply, the switch inspects the reply's Source MAC, learns the host's location, and updates its CAM table. All subsequent traffic to that host becomes known unicast forwarding.
3. Broadcast and Multicast Flooding
Broadcast Frames ( FFFF.FFFF.FFFF ): Transmitted by protocols such as ARP and DHCP. The switch floods the frame out all ports in the originating VLAN except the ingress port.
Multicast Frames ( 0100.5Exx.xxxx for IPv4, 3333.xxxx.xxxx for IPv6): By default, unmanaged switches flood multicast out all ports. On AOS-CX switches with IGMP Snooping enabled, the switch snoops IGMP join/leave messages and forwards multicast streams only to switch ports with subscribed receivers.
Filtering (Frame Dropping)
If a frame arrives on port 1/1/1 and the switch's CAM table indicates that the Destination MAC also resides on port 1/1/1 (for example, traffic traversing an external hub connected to port 1/1/1), the switch filters (drops) the frame because the destination has already received the transmission on the local shared medium.
MAC Aging Timers and Cache Management
Endpoints in enterprise campus networks are dynamic: laptops disconnect, mobile devices roam between wireless APs, and workstations enter sleep states. If a switch retained dynamic MAC entries indefinitely, the CAM table would eventually exhaust its hardware capacity, causing the switch to fall back to constant unknown unicast flooding.
To maintain table accuracy and free hardware resources, AOS-CX implements an automated MAC Aging Timer :
Default Duration: 300 seconds (5 minutes) .
Timer Reset: Every time an incoming frame is observed with a known Source MAC, the switch resets that entry's aging countdown back to 300 seconds.
Aging Eviction: If no frames are received from a given MAC address for 300 consecutive seconds, the switch automatically evicts the entry from the CAM table.
Administrative Tuning: The aging timer can be adjusted globally using the mac-address-table age-time <seconds> command (range 60 to 3600 seconds; default 300).
Topology Change Interaction: As examined in Section 5.3, when Spanning Tree receives a Topology Change Notification (TCN), switches temporarily accelerate aging (reducing the timer to the 15-second Forward Delay) to purge stale routes following a topology shift.
Static MAC Address Provisioning and Use Cases
While dynamic learning accommodates user endpoints, enterprise environments occasionally require deterministic MAC-to-port bindings that bypass learning and never expire.
An administrator configures a Static MAC Address using the following syntax: switch(config)# static-mac 00:50:56:a1:b2:c3 vlan 10 port 1/1/10
Key Characteristics of Static MAC Entries
Permanent Existence: Static entries are not affected by the MAC aging time. They can be assigned only to Layer 2 (non-routed) interfaces and an existing VLAN, and they persist across reboots once the configuration is saved.
Immunity to Overwrite: If an unauthorized device on port 1/1/5 transmits frames with the spoofed source MAC 00:50:56:a1:b2:c3 , the switch does not move the static entry and keeps directing traffic to interface 1/1/10.
Common Deployments: High-availability server clusters, dedicated backup appliances, non-standard industrial controllers, and network security appliances.
Diagnosing and Resolving MAC Address Flapping
MAC address flapping (also known as MAC table thrashing) occurs when a switch rapidly and repeatedly learns the exact same MAC address across two or more different interfaces within a few seconds.
When flapping occurs, the event log shows repeated MAC-move messages. AOS-CX also tracks moves directly: show mac-address-table mac-move lists the move count and history per MAC address and VLAN, and clear mac-address mac-move resets those statistics. A simplified example of the pattern to look for: MAC 00:50:56:9a:1b:2c in VLAN 10 moved from port 1/1/1 to port 1/1/2
MAC 00:50:56:9a:1b:2c in VLAN 10 moved from port 1/1/2 to port 1/1/1 +-----------------------------------------------------------------------------------------+
- | CAUSES OF MAC ADDRESS FLAPPING |
- | |
- | 1. Physical Layer 2 Loop: |
- | Frames circulate around redundant links, arriving at different ports repeatedly. |
- | |
- | 2. Duplicate Hardware MAC: |
- | Two physical devices (or cloned VMs) configured with identical MAC addresses. |
- | |
- | 3. Server Teaming Misconfiguration: |
- | Server NICs connected in active-active mode without an upstream LAG (LACP) trunk. |
- | |
- | 4. Asymmetric Wireless Roaming: |
- | Rapid Wi-Fi roaming without proper client bridge state cleanup. |
- +-----------------------------------------------------------------------------------------+
- Systematic Troubleshooting Methodology
Identify the Flapping MAC: Run show mac-address-table mac-move (or review show events ) to extract the specific MAC address, VLAN ID, and oscillating port pair.
Check for Layer 2 Loops: Verify Spanning Tree operational states on the affected ports ( show spanning-tree ). If ports that should be blocking are in Forwarding, resolve the STP misconfiguration or check for an unmanaged switch loop.
Inspect Connected Devices: Trace physical cabling from the reported ports. If both ports connect to dual NICs on the same physical server, verify that the server's NIC team is configured for LACP and that the switch has an active Link Aggregation Group ( lag ) configured across both ports.
Search for Duplicate Virtual Machines: In virtualized environments (VMware ESXi, Hyper-V, KVM), check hypervisor logs to determine whether two separate virtual machines were cloned from an identical template with static virtual MAC addresses.
AOS-CX Verification and Troubleshooting Commands
The following CLI commands provide complete visibility into the AOS-CX MAC address table: ! View the entire active MAC address table
switch# show mac-address-table
- ! Filter entries by specific VLAN
- switch# show mac-address-table vlan 10
- ! Filter entries by physical interface
- switch# show mac-address-table port 1/1/1
- ! Search for a specific host MAC address
- switch# show mac-address-table address 00:50:56:aa:11:11
- ! Display total count of learned dynamic and static MAC entries
- switch# show mac-address-table count
- ! Show MAC move (flapping) history
- switch# show mac-address-table mac-move
- ! Clear MAC move statistics for one VLAN
- switch# clear mac-address mac-move vlan 10
- Summary Table of MAC Operations
Operational Stage Inspected Field Primary Purpose / Forwarding Outcome
Address Learning Source MAC Address Adds new entry [VLAN, MAC, Port] or resets 300-second aging timer.
Known Unicast Forwarding Destination MAC Address Forwards frame strictly out the single mapped egress interface.
Unknown Unicast Forwarding Destination MAC Address Floods frame out all interfaces in the originating VLAN except ingress.
Broadcast Forwarding FFFF.FFFF.FFFF Floods frame out all interfaces in the originating VLAN except ingress.
Address Aging Idle Timer Expiration Evicts entries inactive for 300 seconds to conserve CAM memory.
Common Exam Traps
Learning vs. Forwarding Mismatch: A classic exam question asks which address is used to populate the CAM table. Remember: Learning is based on Source MAC; Forwarding is based on Destination MAC .
Default Aging Duration: The default dynamic MAC aging timer on AOS-CX switches is 300 seconds (5 minutes). Do not confuse this with the Spanning Tree Forward Delay timer (15 seconds) or ARP cache timers (which typically range from 20 minutes to 4 hours on Layer 3 interfaces).
Flooding Scope: Unknown unicast and broadcast frames are flooded only within the originating VLAN . A Layer 2 switch will never flood frames across VLAN boundaries.
MAC Flap Meaning: MAC flapping does not indicate that a client is renewing its DHCP lease or that an interface is negotiating PoE power. It indicates a severe Layer 2 loop, a duplicate MAC conflict, or an improper multi-homed server NIC team.