Introduction · Topic 1 of 2
Layer 2 Forwarding and MAC Learning
Learn how Ethernet frames are forwarded by MAC address, how bridges and switches learn addresses, and which RouterOS interface settings matter.
- 5 min
- A bridge forwards by destination MAC address and learns from the source MAC address.
- Broadcast frames go to
FF:FF:FF:FF:FF:FFand reach every port in the bridge. - A multicast MAC has the lowest bit of its first byte set.
What it is
Layer 2 forwarding moves Ethernet frames between ports by looking at MAC addresses.
A switch or bridge does not read IP addresses to decide where a frame goes. It reads the destination MAC address in the Ethernet header and picks an outgoing port. This happens inside one broadcast domain, before any routing.
Every frame carries a source MAC address and a destination MAC address. The kind of destination decides how the frame is treated.
How it works
A bridge learns source addresses, then forwards by destination address, and floods when it must.
Unicast, multicast and broadcast
The three traffic types differ only in the destination MAC address.
| Type | Destination MAC | Normal bridge behaviour |
|---|---|---|
| Unicast | One specific device | Sent to one port if the address is known |
| Broadcast | FF:FF:FF:FF:FF:FF | Sent out of every port in the bridge except the ingress port |
| Multicast | Group address, lowest bit of the first byte set | Flooded by default, unless IGMP snooping limits it |
A unicast frame to an address the bridge has not learned is called unknown unicast. The bridge floods it, so the destination still receives it. Once the destination replies, the bridge learns its port and later frames are not flooded.
Broadcasts such as ARP requests always reach every host in the broadcast domain. That is why large flat networks suffer, and why VLANs are used to split them.
MAC learning
Learning is driven only by the source address of each incoming frame.
- A frame arrives on a port.
- The bridge records the source MAC address against that port in its host table.
- The bridge looks up the destination MAC address.
- If the destination is known, the frame goes to that port only. If not, it is flooded.
Entries are not kept forever. An entry that is not refreshed is removed when the ageing time expires. On a RouterOS bridge this is the ageing-time setting, and the default is five minutes.
/interface bridge host print
/interface bridge set bridge1 ageing-time=5mIf a host moves to another port, the next frame it sends updates the entry. A frame is never sent back out of the port it arrived on.
/interface bridge host print is the quickest way to see which port a MAC address was learned on.
Interface settings
Link settings must agree on both ends of a cable, or you get errors and poor speed.
Ethernet ports negotiate speed and duplex by default. The main settings live under /interface ethernet.
/interface ethernet print
/interface ethernet monitor ether1
/interface ethernet set ether1 auto-negotiation=yes
/interface ethernet set ether1 speed=100Mbps full-duplex=yes auto-negotiation=no| Setting | Purpose |
|---|---|
auto-negotiation | Negotiates speed and duplex with the link partner |
speed and full-duplex | Fixed values, used when negotiation is off |
advertise | Which speeds are offered during negotiation |
tx-flow-control, rx-flow-control | Pause frame behaviour |
l2mtu and mtu | Frame and packet size limits, covered in the MTU chapter |
/interface ethernet monitor shows the state that was actually agreed, such as the rate and duplex. Compare it with the other end when you suspect a mismatch.
A common fault is one side fixed at full duplex and the other left on auto-negotiation. The auto side may settle on half duplex, which causes collisions and slow transfers. Use the same method on both ends.
What to remember for the exam
Seven facts cover most questions on this topic.
- A bridge forwards by destination MAC address and learns from the source MAC address.
- Broadcast frames go to
FF:FF:FF:FF:FF:FFand reach every port in the bridge. - A multicast MAC has the lowest bit of its first byte set.
- Unknown unicast frames are flooded until the destination is learned.
- Learned entries age out after the
ageing-time, which is five minutes by default. /interface bridge host printshows the learned MAC table./interface ethernet monitorshows the negotiated speed and duplex.
A frame is never sent back out of the port where it arrived, so a bridge cannot create a loop by itself with a single link.
Common mistakes
These four mistakes appear often.
Learning from the destination. The bridge learns from the source MAC address only. The destination address is used for the lookup.
Treating unknown unicast as a drop. The bridge floods it, which is why the first frame to a new host still arrives.
Mismatched duplex. One end fixed and the other on auto-negotiation can give a half duplex result, with errors and slow throughput.
Confusing MAC and IP forwarding. A bridge or switch never changes the MAC addresses of a frame. A router rewrites them at every hop.
Check yourself
Work through these three questions.
Which address does a bridge learn from, and which does it use for the lookup?
It learns from the source MAC address and looks up the destination MAC address.
What does a bridge do with a unicast frame whose destination MAC it has not learned?
It floods the frame out of all other ports until the destination answers and its port is learned.
Which command shows the MAC addresses a RouterOS bridge has learned?
/interface bridge host printshows the learned entries and the port for each one.
Topic 1 of 2 in Introduction
Test yourself on Introduction
The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.