An Ethernet switch forwards frames by destination MAC address. It learns each sender's address and port from incoming traffic, stores the pair in a table, and sends later frames only to the matching port. Unknown or broadcast destinations are flooded to every port in the same VLAN.
What does a switch actually decide?
A frame carries a source MAC address, a destination MAC address and a payload. The switch looks at the source and writes "this address lives on port 7" into its forwarding table. Then it looks at the destination. If the table has an entry, the frame leaves on that one port. If not, the switch floods it everywhere except the port it arrived on.
This is why a switch is different from an old hub. A hub repeated every bit to every port. A switch gives each pair of talking devices something close to a private path, which cuts collisions and also cuts how much traffic a casual listener sees.
Where do IP addresses fit in?
Switches work at layer 2 and do not read IP. Hosts still need to find the MAC address for an IP they want to reach. ARP, defined in RFC 826, does that: a host broadcasts "who has this IP" and the owner answers with its MAC. IP packets then ride inside Ethernet frames, as described in RFC 894.
Notice that ARP has no built in proof of identity. Any device on the segment can answer, which is the root of ARP spoofing.
What are VLANs for?
A VLAN splits one physical switch into several separate broadcast domains. A frame tagged for VLAN 20 is only flooded to ports in VLAN 20. A trunk port carries several VLANs between switches by adding a tag to each frame.
Constructed example: a small clinic puts reception PCs on VLAN 10, medical devices on VLAN 20 and guest Wi-Fi on VLAN 30. A broadcast storm from a faulty guest laptop stays inside VLAN 30. Traffic between VLANs must pass through a router or firewall, which is the point where you can apply rules.
What can go wrong?
- MAC table flooding. The table has finite memory. If an attacker sends frames with thousands of fake source addresses, a switch with no protection may fill the table and start flooding traffic like a hub. Port security limits how many addresses one port may use.
- ARP spoofing. An attacker answers ARP requests with its own MAC to sit in the path. MITRE describes this class of behavior under adversary in the middle.
- Sniffing. Capturing traffic from a mirrored port or a promiscuous interface is covered in MITRE's network sniffing technique.
- Loops. Two cables between the same switches without loop prevention can create a broadcast storm that takes the segment down. Spanning tree protocols exist to block redundant paths.
- Trunk misconfiguration. A user port that negotiates a trunk can see tagged traffic from other VLANs.
How to check or apply this
- List every switch and its role, then confirm firmware is current and management is on a separate VLAN with strong authentication.
- Turn off trunk negotiation on user ports and set them as fixed access ports.
- Enable port security or sticky MAC limits on access ports where devices are known.
- Turn on loop protection and BPDU guard on edge ports.
- Enable dynamic ARP inspection and DHCP snooping if your switches support them.
- Disable unused ports and put them in an unused VLAN.
- Put a firewall between VLANs, not just a router with open rules.
Quick check
Does a switch stop eavesdropping?
It reduces it, because frames go only to the right port. It does not remove it. Spoofing, table flooding and port mirroring can all expose traffic, so encrypt data in transit as well.
Is a VLAN a security boundary?
It is a separation boundary that only holds if trunks, native VLANs and inter VLAN routing are configured carefully. Treat it as one layer and enforce policy at a firewall.
Sources
- RFC 826, An Ethernet Address Resolution Protocol
- RFC 894, A Standard for the Transmission of IP Datagrams over Ethernet Networks
- MITRE ATT&CK T1557, Adversary in the Middle
- MITRE ATT&CK T1040, Network Sniffing
Last reviewed: 18 October 2026.
