📘 CCNA 200-301 v1.1
1.13 Describe switching concepts
1.13.c Frame Flooding
What is Frame Flooding?
Frame flooding is a behavior of a switch that occurs when the switch does not know the destination MAC address of an incoming Ethernet frame.
In such cases, the switch forwards (floods) the frame out of all ports, except the one it was received on.
This allows the frame to reach its intended destination, and once the destination device replies, the switch learns where that device is located.
Understanding Why Flooding Happens
Switches operate at Layer 2 (Data Link Layer) of the OSI model.
They forward frames based on MAC addresses stored in their MAC address table (also called the CAM table — Content Addressable Memory table).
Here’s the logic a switch follows when it receives a frame:
- Read the Source MAC Address
- The switch looks at the frame’s source MAC address and records it in its MAC address table along with the port number it came from.
- This helps the switch remember which device is connected to which port.
- Check the Destination MAC Address
- The switch checks if the destination MAC address is already in its MAC address table.
- Decide What to Do:
- If the destination MAC is known:
→ The switch forwards the frame only to that specific port (called unicast forwarding). - If the destination MAC is unknown:
→ The switch floods the frame out of all ports except the incoming one.
- If the destination MAC is known:
This is called frame flooding.
When Does Frame Flooding Occur?
There are three main situations when flooding happens:
1. Unknown Unicast Flooding
- When the destination MAC address is not in the MAC address table.
- Example (IT-based):
- A new device (PC1) sends traffic to another device (PC2) that hasn’t communicated before.
- The switch doesn’t yet know which port PC2 is connected to.
- The switch floods the frame out of all ports so that PC2 can receive it and reply.
- Once PC2 replies, the switch learns PC2’s MAC address and its port.
- From then on, communication between PC1 and PC2 will be unicast (not flooded).
2. Broadcast Flooding
- When the destination address is a broadcast address (FF:FF:FF:FF:FF:FF).
- Broadcast frames are meant for all devices in the same LAN (broadcast domain).
- Switches always flood broadcast frames out of all ports (except the incoming one).
- Example in IT:
- When a device sends an ARP Request (asking, “Who has this IP address?”), it uses a broadcast frame.
- The switch floods this ARP Request to all devices in that VLAN.
3. Multicast Flooding (in certain cases)
- If the switch doesn’t have IGMP snooping enabled or doesn’t know which ports want multicast traffic,
it will flood multicast frames to all ports in that VLAN. - With IGMP snooping enabled, the switch learns which ports have requested multicast traffic and stops flooding to others.
Flooding Behavior Summary
| Type of Frame | Reason for Flooding | Example IT Scenario |
|---|---|---|
| Unknown Unicast | Destination MAC not in the MAC table | First time one device communicates with another |
| Broadcast | Destination is FF:FF:FF:FF:FF:FF | ARP Requests, DHCP Discover |
| Multicast | No IGMP Snooping or unknown multicast group | Streaming video multicast without control protocol |
How Flooding Helps and Why It’s Controlled
Flooding is necessary because it ensures that communication can happen even when the switch doesn’t yet know where a device is located.
However, too much flooding can cause performance issues.
For example:
- In large networks, too much broadcast or unknown unicast traffic can consume bandwidth and reduce performance.
- Therefore, network administrators use VLANs to limit flooding to specific network segments.
How the Switch Learns and Stops Flooding
After a device replies to the flooded frame, the switch:
- Learns the device’s MAC address from the response.
- Updates the MAC address table with the MAC and the port number.
- Next time, frames for that destination will be forwarded only to the correct port, not flooded.
This process is part of MAC address learning and aging, which you already studied in topic 1.13.a.
Flooding and the MAC Address Table
- Each switch has a MAC address table that keeps track of which MAC address belongs to which port.
- The table entries age out after a period (default 300 seconds on Cisco switches).
- If a device doesn’t send traffic for a long time, its entry is removed.
- The next time someone sends traffic to that device, the switch floods again until it relearns the address.
Important CCNA Key Points to Remember
| Concept | Description |
|---|---|
| Flooding Definition | Sending a frame out all ports (except the one it came in) because the destination MAC is unknown or broadcast. |
| Layer | Happens at Layer 2 (Data Link Layer). |
| Unknown Unicast Flooding | Happens when destination MAC is not in the switch’s MAC table. |
| Broadcast Flooding | Happens when destination MAC = FF:FF:FF:FF:FF:FF. |
| Multicast Flooding | Happens when multicast groups are not known to the switch. |
| How to Control Flooding | Use VLANs, IGMP snooping, and manage MAC address table size. |
| When Flooding Stops | When switch learns the destination MAC address and port. |
Example in an IT Environment
Imagine a small office switch:
- Port 1: PC1
- Port 2: PC2
- Port 3: PC3
- Port 4: Server
If PC1 sends a frame to PC4 (but the switch doesn’t know PC4’s MAC yet):
- The switch floods the frame to ports 2, 3, and 4.
- PC4 receives it and replies.
- The switch learns that PC4 is on port 4.
- Now future frames from PC1 to PC4 go directly to port 4 — no more flooding.
In Summary
Network administrators control flooding with VLANs and proper configuration.
Frame flooding is a normal and necessary behavior in switches.
It happens when the switch doesn’t yet know where to send a frame.
It ensures communication succeeds even when addresses are unknown.
Once the switch learns the addresses, flooding stops.
Flooding can happen for unknown unicast, broadcast, or multicast traffic.
