What is MAC Address Aging?

Understanding MAC Address Aging

MAC address aging is a network switch feature that controls how long a learned MAC address remains in the switch's MAC address table (CAM table) before it is removed. Entries that have not been seen as a source address within a configurable aging time are deleted, keeping the forwarding table current with only active devices.

A switch learns MAC addresses by recording the source address and ingress port of each frame. Every entry carries a timer; when a frame from that MAC arrives, the timer resets. If no traffic from the address is seen before the aging time expires (commonly 300 seconds by default on Cisco switches), the switch purges the entry. The next frame destined to that address is then flooded out all ports in the VLAN until the device responds and is relearned. This recycling prevents the finite CAM table from filling with stale entries.

For security and stability, appropriate aging matters in several ways. Too long an aging time wastes table space and can keep stale entries that misdirect frames, while too short a time causes excessive unicast flooding that can be eavesdropped. The CAM table's finite size is also why MAC flooding attacks work: an attacker rapidly generates bogus source MACs to overflow the table, forcing the switch to flood traffic so it can be sniffed. Aging interacts with that threat, and defenses like port security and DHCP snooping complement it.

For example, a network administrator notices intermittent unicast flooding on a VLAN where servers send traffic in long, quiet bursts. Their replies age out of the CAM table between bursts, so the switch floods each new burst until it relearns the address. The administrator lengthens the MAC aging time on that VLAN to exceed the servers' idle interval, keeping the entries alive, eliminating the unnecessary flooding, and reducing exposure of that traffic to other ports.