Why does an Ethernet switch age out MAC address table entries, and what happens to traffic for a host that falls silent?

## What ageing is An Ethernet switch learns each host's location from the **source MAC address** of the frames it sends, storing the address with the port it arrived on. Each entry also carries the time it was last refreshed. **Ageing** is the rule that removes an entry when no frame **from** that address has been seen for longer than the **ageing time**. - The timer is **refreshed by traffic from the host**, not by traffic to it. A host that receives a steady stream but never sends still ages out. - The timer is **per entry**: busy hosts stay, idle ones go. - Statically configured entries normally do not age; dynamically learned ones always do. ## The value and whose it is The default comes from the IEEE bridging standard, not from an RFC. The Bridge MIB (RFC 4188) describes its `dot1dTpAgingTime` object as "the timeout period in seconds for aging out dynamically-learned forwarding information" and notes that "802.1D-1998 recommends a default of 300 seconds". The same object allows any value from 10 to 1,000,000 seconds, so the 300-second figure is a recommended default that operators and implementations may change, not a fixed protocol constant. ## Why a switch ages entries at all 1. **Table space.** The table has a fixed size in hardware. Without ageing, every MAC address ever seen (guests, replaced laptops, short-lived virtual machines) would stay until the table filled. 2. **Stale locations.** When a host moves to another port or another switch, its old entry points the wrong way. Ageing guarantees a wrong entry eventually disappears even if the host never speaks from its new place. (If it does speak, the switch overwrites the entry immediately; ageing is the fallback, not the main mechanism.) 3. **Removed hosts.** A switched-off host's entry is reclaimed instead of occupying a slot. ## What a silent host costs Once a host's entry ages out, the switch no longer knows its port. A frame addressed to it is now **unknown unicast**, and the switch **floods** it out every port in the VLAN except the arrival port. Nothing breaks: the host still receives the frame. But: - every other host on the VLAN receives and discards traffic that was never meant for it; - a large stream (a backup, a log feed, a video stream) to a receive-only host can consume bandwidth on every port in the VLAN; - every host on the VLAN can now capture that traffic, which matters for privacy. ## The classic production case: asymmetric routing The textbook symptom is **unicast flooding caused by mismatched timers**. 1. A router has the host in its **ARP cache** (the IPv4 table that maps the host's IP address to its MAC address). ARP cache lifetimes are an implementation choice, and some routers keep entries for hours. 2. Return traffic from the host leaves through a **different** router or path, so the switch never sees the host's frames on this segment. 3. After the ageing time the switch forgets the host; the first router, still holding a valid ARP entry, keeps sending unicast frames to the host's MAC address without re-asking. 4. The switch floods every one of those frames, for as long as the ARP entry lives. | Timer | Owner | Typical relationship | |---|---|---| | MAC ageing | the switch (802.1D recommends 300 s) | the shorter one | | ARP cache lifetime | the router or host (implementation choice) | often much longer | The usual fixes keep the two consistent: make the router refresh ARP entries more often than the switch ages MAC entries (the ARP exchange makes the host transmit, which relearns it), or raise the MAC ageing time on that VLAN, or add a static entry for a host that legitimately never transmits. ## Choosing the ageing time - **Too short**: quiet hosts age out constantly and their traffic floods. - **Too long**: a host that moved but stays silent is black-holed at its old port for longer, and the table holds more dead entries. RFC 4188's security section adds that a large value "may simplify forwarding table overflow attacks", because spoofed addresses then stay longer. ## Finding it in practice Flooding to a silent host shows up as unexpected unicast traffic for another host's MAC address arriving on unrelated ports, and as that host's entry missing from the switch's table while traffic to it continues.