How a switch works — the MAC address table
Every switch maintains a MAC address table (also called a CAM table — Content Addressable Memory). This table maps MAC addresses to the physical ports they were learned from. When a frame arrives, the switch checks this table to decide where to send it.
Switches learn MAC addresses automatically by inspecting the source address of every frame that arrives. If a device sends traffic from port 3, the switch records that MAC address against port 3. Over time the table fills up with all the devices on the network.
1. Frame arrives → Switch receives frame on a port 2. Learn source MAC → Records source MAC address → port in the MAC table 3. Look up dest MAC → Checks MAC table for destination address If found: → Forwards frame out the specific port only (unicast) If not found: → Floods frame to ALL ports except the one it arrived on If broadcast: → Floods frame to ALL ports in the VLAN (FF:FF:FF:FF:FF:FF)
Hub (Layer 1): Repeats every signal to every port. All devices share bandwidth. Any transmission creates a collision domain. Obsolete.
Switch (Layer 2): Sends frames only to the destination port. Each port is its own collision domain. Devices get dedicated bandwidth. Standard in all modern networks.
The exam loves asking which device creates a single collision domain (hub) vs which device creates separate collision domains per port (switch).
Switch vs router — the key difference
This is one of the most tested distinctions across both A+ and Network+. The difference comes down to what address each device uses and which layer it operates at.
| Feature | Switch | Router |
|---|---|---|
| OSI Layer | Layer 2 (Data Link) | Layer 3 (Network) |
| Address used | MAC address | IP address |
| Connects | Devices within the same network | Different networks together |
| Traffic scope | Within a subnet / VLAN | Between subnets / networks |
| Broadcast domain | All ports share one (unless VLANs used) | Separates broadcast domains |
| Table used | MAC address table (CAM) | Routing table |
Managed vs unmanaged switches
VLANs — virtual LANs
A VLAN (Virtual Local Area Network) logically segments a physical switch into multiple separate networks. Devices on different VLANs cannot communicate with each other directly — they need a router or Layer 3 switch to route between them. VLANs are one of the most tested switch topics on Network+.
The main reasons to use VLANs are security (isolating sensitive systems), performance (reducing broadcast traffic), and flexibility (grouping devices by function rather than physical location).
Access port → Carries traffic for ONE VLAN — connects to end devices (PCs, printers) Trunk port → Carries traffic for MULTIPLE VLANs — connects switches to each other or to routers 802.1Q → VLAN tagging standard — inserts a 4-byte tag into the Ethernet frame Native VLAN → VLAN that carries untagged traffic on a trunk port (default VLAN 1) Inter-VLAN routing → Traffic between VLANs requires a router or Layer 3 switch
An access port belongs to one VLAN and connects to an end device. The device doesn't know or care about VLANs — the switch handles the tagging.
A trunk port carries multiple VLANs and connects switches together (or a switch to a router). Frames on a trunk are tagged with 802.1Q to identify which VLAN they belong to.
If the exam describes a port connecting two switches — it's a trunk. If it describes a port connecting a PC — it's an access port.
Spanning Tree Protocol (STP)
When you connect multiple switches together for redundancy, you create loops — and Layer 2 loops are catastrophic. A broadcast frame in a loop circulates forever, consuming all bandwidth in seconds (called a broadcast storm). STP prevents this by automatically blocking redundant paths while keeping them available as backup.
| STP Version | Standard | Key improvement |
|---|---|---|
| STP | 802.1D | Original — slow convergence (30–50 seconds) |
| RSTP | 802.1w | Rapid STP — much faster convergence (seconds) |
| MSTP | 802.1s | Multiple STP — separate spanning tree per VLAN group |
| PVST+ | Cisco | Per-VLAN Spanning Tree — one STP instance per VLAN |
Port security
Port security is a managed switch feature that restricts which MAC addresses are allowed on a given port. It's used to prevent unauthorised devices from connecting to the network — plugging an unknown laptop into a network port can be blocked by port security.
Protect: Drops frames from unauthorised MACs silently — no alert, no shutdown.
Restrict: Drops frames and increments a violation counter — generates a log but port stays up.
Shutdown (default): Disables the port completely — requires manual re-enabling by an administrator. Most secure option.
Exam scenarios
Studying for A+ or Network+?
The study guides, practice exams, and free resources worth your time for both exams.