6-2
The following is how an AP learns a MAC address when it receives a frame from a port, Port A for
example:
1) Check the source MAC address (MAC-SOURCE for example) of the frame. Assume that frames
with the source MAC address MAC-SOURCE can be forwarded through Port A.
2) Look up the MAC address table by the MAC address for a match and do the following:
z
If an entry is found for the MAC address, update the entry.
z
If no entry is found, add an entry for the MAC address to indicate from which port the frame is
received.
When receiving a frame destined for MAC-SOURCE, the AP looks up the MAC address table and
forwards it from Port A.
To adapt to network changes, MAC address table entries need to be constantly updated. Each
dynamically learned MAC address table entry has a life time, that is, an aging timer. If an entry has not
updated when the aging timer expires, it is deleted. If it updates before the aging timer expires, the
aging timer restarts.
Manually configuring MAC address entries
With dynamic MAC address learning, the AP does not tell illegitimate frames from legitimate ones. This
brings security hazards. For example, if a hacker sends frames with a forged source MAC address to a
port different from the one where the real MAC address is connected to, the AP will create an entry for
the forged MAC address, and forward frames destined for the legal user to the hacker instead.
To enhance the security of a port, you can manually add MAC address entries into the MAC address
table of the AP to bind specific user devices to the port. Because manually configured entries have
higher priority than dynamically learned ones, you can thus prevent hackers from stealing data using
forged MAC addresses.
Types of MAC Address Table Entries
A MAC address table may contain these types of entries:
z
Static entries, which are manually configured and never age out.
z
Dynamic entries, which can be manually configured or dynamically learned and may age out.
z
Blackhole entries, which are manually configured and never age out. Blackhole entries are
configured for filtering out frames with specific source or destination MAC addresses. For example,
to block all packets destined for a specific user for security concerns, you can configure the MAC
address of this user as a blackhole destination MAC address entry.
Dynamically-learned MAC addresses cannot overwrite static or blackhole MAC address entries, but the
latter can overwrite the former.
MAC Address Table-Based Frame Forwarding
When forwarding a frame, the AP uses the following two forwarding modes based on the MAC address
table:
