What a switch actually looks at
A switch never opens an IP (Internet Protocol) packet or reads a URL (Uniform Resource Locator). It reads exactly one thing: the Ethernet frame wrapped around whatever payload it's carrying, and mostly just two fields inside it, the source and destination MAC (Media Access Control) addresses. Think of a frame like an internal office courier envelope: it doesn't matter what department wrote the memo inside, the courier only reads "to desk 14B, from desk 3A" on the outside and moves on.
MAC address structure
A MAC address is 48 bits, written as six hex byte pairs like 3C:5A:B4:02:9F:E1. It's burned into (or configured on) a network interface and is meant to be globally unique.
- The first 24 bits are the OUI (Organizationally Unique Identifier), assigned to the manufacturer.
3C:5A:B4might be Cisco, another block might be Intel; you can look up a device's vendor from just its OUI. - The last 24 bits are a serial number the manufacturer assigns, unique within that OUI.
- A frame sent to
FF:FF:FF:FF:FF:FFis a broadcast: every device on the segment accepts it. - Certain address ranges are reserved for multicast: one frame, accepted by a specific group of interested devices rather than everyone.
The two fields that actually matter
- Destination MAC: the switch checks this against its MAC address table to decide which single port to forward the frame out of. No match means it floods out every port except the one it arrived on.
- Source MAC: every time a frame arrives, the switch notes "this MAC lives on this port" and stores it in its MAC table, so the next reply back doesn't need to be flooded.
- Type/Length: tells the receiving device what's riding inside the payload:
0x0800means an IPv4 (Internet Protocol version 4) packet is next,0x0806means ARP (Address Resolution Protocol),0x86DDmeans IPv6 (Internet Protocol version 6). - FCS (Frame Check Sequence): a CRC (Cyclic Redundancy Check) checksum the receiver uses to detect a corrupted frame and silently drop it. There's no built-in retransmission at this layer. That's Transport's job, further up the stack.
Every incoming frame teaches the switch one new fact (source MAC → this port) and asks it one question (destination MAC → which port). That's the entire MAC-learning and forwarding process this whole module builds on.