A "normal" switch operates on the Layer 2 of the OSI-Model and uses MAC-addresses to forward frames to the right port. It stores the MAC-addresses in a table.

Ethernet switches come in various sizes / number of RJ-45 ports and with different capabilities, mainly categorized as managed or unmanaged and small or 19-inch / rack-mounted.

Small switch

TP-Link TL-SG108 | 8 Port Switch | Unmanaged | Small form factor

Rackmount switch

TP-Link TL-SG1024 | 24 Port Switch | Unmanaged | Rackmounted

This is what a CAM-Table (Content Addressable Memory Table) looks like:

CAM Table

We will use this table as our example here.

The timeout time determines how long the switch saves the MAC-addresses with their belonging ports. In this case it is 300 seconds.

When the device "23:8f:6a:90:1c:33" (Port 15) wants to send a frame to the device "7f:61:3b:14:8d:7a" (Port 16), the switch looks inside the frame to determine the target device's MAC-address. Then it checks whether it already knows the target or not (lookup). In this case it knows the target is on Port 16, so it forwards the frame to it.

Now let's say, the device "7f:61:3b:14:8d:7a" wants to send a frame to another device in the network, which is not in the CAM-table yet (f4:2d:1e:9a:74:56). The device will perform an ARP request: It requests the MAC-address of the device with the IP-Address it wants to send the frame to (What MAC-address is belonging to this IP-address?). This request is being sent to the broadcast-MAC (ff:ff:ff:ff:ff:ff).

The switch receives this ARP-Request on Port 16. Since the destination MAC of the request is a broadcast, the switch sends the frame to all ports (except port 16). This is called flooding. The device with the right IP-Address responds with an "ARP-Reply" along with its MAC-address. The switch learns from the reply, and adds "f4:2d:1e:9a:74:56" to its CAM-Table with its belonging port:

CAM Table after new MAC

Managed vs. Unmanaged

A managed switch allows you to configure a lot more in your network, like setting up VLANs to separate traffic, prioritize ports, and monitor and troubleshoot issues with a web interface.