What Does CAM table Mean?

Imagine you are the mailroom manager for a large office building. Every day, letters arrive addressed to different people in different offices. If you had no memory of where anyone sits, you would have to shout each person's name and wait for them to come get their mail. That would be slow and disruptive. Now imagine you keep a clipboard with a list of every employee and their office number. When a letter arrives, you check your clipboard, walk directly to the correct office, and hand it over. That is what a CAM table does for a network switch.

The switch is a device that connects computers, printers, servers, and other devices in a local network. Each device has a unique hardware identifier called a MAC address, which is like a serial number burned into its network card. When a device sends data, the switch sees the source MAC address and the port the data came in on. The switch writes that information into its CAM table. Later, when another device wants to send data to that first device, the switch looks up the destination MAC address in the CAM table, finds the matching port, and forwards the data only out that specific port.

Without a CAM table, a switch would behave like a hub, sending every message out every port, which wastes bandwidth and creates security risks. With a CAM table, the switch learns exactly where each device lives. The table is dynamic, meaning it updates automatically as devices connect, disconnect, or move to different ports. Entries also have a timeout, so if a device goes silent for a while, its entry is removed to keep the table current. This learning process is a fundamental part of how Ethernet switches work and is essential for building fast, secure local area networks.

A CAM table, also called a MAC address table or content-addressable memory table, is a data structure stored in the memory of an Ethernet switch. It maps destination MAC addresses to specific switch ports and VLANs. The term CAM refers to content-addressable memory, a specialized type of high-speed memory that allows the switch to perform lookups in a single clock cycle, which is critical for wire-speed forwarding.

The CAM table is built dynamically using a process called MAC address learning. When a frame arrives on an ingress port, the switch examines the source MAC address field in the Ethernet header. If that MAC address is not already in the CAM table, the switch creates a new entry associating that MAC address with the ingress port and the VLAN ID of the frame. If the entry already exists, the switch optionally refreshes its aging timer. The default aging timer on most Cisco switches is 300 seconds, but this can be adjusted using the command "mac address-table aging-time" in global configuration mode.

When a frame arrives with a destination MAC address, the switch performs a lookup in the CAM table. If a matching entry is found, the switch forwards the frame only out of the port listed in that entry. This is called unicast forwarding. If no matching entry exists, the switch floods the frame out of all ports in the same VLAN except the ingress port. This is called unknown unicast flooding. Broadcast frames (destination MAC address FF:FF:FF:FF:FF:FF) are always flooded, because they are intended for all devices.

The CAM table has a finite size, typically ranging from a few thousand entries on small access switches to over a hundred thousand on modular enterprise switches. When the table is full, the switch cannot learn new MAC addresses and must flood frames for any unknown destination, which increases CPU load and can degrade performance. This is a common attack vector in MAC flooding attacks, where an attacker sends frames with many different source MAC addresses to fill the CAM table and force the switch into hub mode, allowing packet sniffing.

VLANs add another layer to the CAM table. Each entry includes a VLAN ID, because the same MAC address can exist in different VLANs. The switch uses both the destination MAC address and the VLAN ID to determine the outgoing port. This is why trunk ports with multiple VLANs require careful planning of MAC address learning across VLANs.

On Cisco IOS, you can view the CAM table with the command "show mac address-table" or the older "show mac-address-table". You can clear the table with "clear mac address-table dynamic". Static MAC address entries can be configured using "mac address-table static" to hard-code a MAC address to a specific port, which is sometimes used for security or to guarantee certain traffic is not flooded.

The CAM table is the core mechanism that allows Ethernet switches to be intelligent forwarding devices rather than simple repeaters. Without it, every frame would be broadcast to every port, consuming bandwidth and creating unnecessary collisions in half-duplex environments. In modern full-duplex switched networks, the CAM table enables simultaneous conversations between different pairs of devices without interference, dramatically increasing network throughput.

From a practical IT perspective, understanding the CAM table is essential for troubleshooting connectivity issues. If a device cannot communicate with another device on the same VLAN, a common first step is to check whether the switch has learned the destination MAC address in its CAM table. The command "show mac address-table" can reveal whether a device is connected to the expected port, whether it has been learned on the correct VLAN, or whether the entry has aged out. Network engineers also use the CAM table to verify that traffic is being forwarded as expected across trunk links and to identify devices that are moving between ports unexpectedly, which can indicate a bridging loop or a misconfigured port security feature.

Security professionals must also understand CAM table behavior. A MAC flooding attack can force a switch into fail-open mode, allowing an attacker to receive traffic destined for other hosts. Mitigations include port security with a maximum MAC address limit, dynamic ARP inspection, and using private VLANs. The CAM table is involved in Spanning Tree Protocol operations, where temporary MAC address table changes occur during topology changes, and understanding this helps prevent packet loss during failovers.

CAM table questions on the CCNA exam typically fall into three patterns: forwarding behavior scenarios, show command interpretation, and troubleshooting scenarios.

Forwarding behavior scenarios: The question describes a small network topology with a switch connected to several hosts. It provides a partially populated CAM table and asks which port(s) will receive a frame when a specific host sends a frame to a specific destination. For example, "Switch SW1 has the following MAC address table entries: VLAN10 00:11:22:33:44:AA - Gi0/1, VLAN10 00:11:22:33:44:BB - Gi0/2. Host A with MAC 00:11:22:33:44:AA sends a frame to Host C with MAC 00:11:22:33:44:CC. How will SW1 forward the frame?" The correct answer is that since Host C's MAC is not in the table, SW1 will flood the frame out of all ports in VLAN10 except Gi0/1. These questions test your understanding of learning, forwarding, and flooding.

Show command interpretation: You are given the output of "show mac address-table" or "show mac address-table vlan 10" and asked to identify which MAC addresses are dynamically learned, which are static, how many entries exist, or which port a particular MAC address is associated with. Sometimes the output shows an empty table, and you must explain why (e.g., no traffic has been sent, or aging timer expired). Another variant shows multiple entries for the same MAC address on different VLANs, testing your understanding of VLAN isolation.

Troubleshooting scenarios: A user complains that they cannot reach a server on the same VLAN. You are given partial outputs from the switch. The CAM table shows the server's MAC address on a different port than expected, or it shows no entry for the server at all. You must identify the cause: perhaps the server is connected to the wrong port, the port is in the wrong VLAN, the server is not transmitting (e.g., powered off, bad cable), or the CAM table entry aged out because of no recent traffic. Another troubleshooting scenario involves port security: a violation has occurred because too many MAC addresses were learned on a single port. You need to know that the CAM table will show the offending MAC addresses and that you can use "show port-security" to investigate.

Some questions are more conceptual: "What happens to the CAM table entries when spanning tree recalculates?" The answer is that entries pointing to ports that are now blocking may be aged out or cleared immediately, depending on the STP version. Also, questions about MAC flooding attacks ask: "What is the effect of an attacker sending frames with many different source MAC addresses to a switch?" Correct answer: the CAM table fills, and the switch begins flooding frames for unknown destinations, allowing the attacker to see traffic that would otherwise be unicast.

Finally, configuration-based questions: "Which command is used to configure a static MAC address in the CAM table?" Options: "mac address-table static", "switchport port-security mac-address", etc. You must know the correct syntax and that static entries do not age out.

The CAM table is one of the most fundamental components of any Ethernet switch. As a network professional, you need to be comfortable inspecting and interpreting CAM table data in real-world environments. The primary command to view the CAM table on Cisco IOS is "show mac address-table". This command shows you all dynamic, static, and secure MAC addresses the switch has learned, along with their associated VLAN, port, and type (STATIC, DYNAMIC, or SECURE).

When you are troubleshooting a connectivity issue, the first thing to check is whether the switch has learned the MAC address of the source and destination devices. Suppose a user reports that they cannot reach the file server at 192.168.1.100. You can ping the server from the user's computer to generate traffic, then examine the CAM table on the switch. If the server's MAC address is not present, the server may not be sending frames (e.g., it is off, the cable is bad, or it is in a different VLAN). If the server's MAC shows up on an unexpected port, someone may have plugged the server into the wrong port, or there may be a bridging loop causing the MAC to flap between ports.

MAC address flapping occurs when the same MAC address is learned on multiple ports within a short time. This is usually a sign of a loop in the network, frames from the same source arriving via different paths. The switch will log a message like "%SW_MATM-4-MACFLAP_NOTIF: Host 00:11:22:33:44:55 in vlan 10 is flapping between port Gi0/1 and Gi0/2". Spanning Tree Protocol is designed to prevent loops, but flapping can still occur during topology changes or due to misconfiguration. As a professional, you should investigate the switch log and use "show spanning-tree" to check for blocked or forwarding ports.

Another common practical task is configuring static MAC addresses. You might want to guarantee that a critical server's traffic is never flooded and always goes out a specific port. You can use "mac address-table static [mac] vlan [vlan] interface [port]". This entry will never age out and cannot be overwritten by dynamic learning. This is also useful for connecting devices that do not send frames, such as network-based printers that only listen.

Finally, port security interacts directly with the CAM table. When you set "switchport port-security maximum 1", the switch will only learn one MAC address on that port. Any additional source MAC attempts trigger a violation (shutdown, protect, or restrict). The learned addresses show up in the CAM table with a type of "SECURE". You can view them with "show mac address-table secure" or "show port-security address". Understanding this relationship helps you design secure access-layer networks.