When the destination MAC address is a multicast or broadcast address or when the destination MAC address has not been learned by the switch (is not in its MAC addresses table) the switch will flood all the ports (except the one from which the frame was received).
For Example:
In a network scenario like the one shown above, initially:
1. If ARP Protocol is running (Static ARP Disabled),
- ARP Request packet will be sent by the source node to the switch. The switch will update its table and in turn will broadcast the ARP Request to all the nodes except the source node.
- The Switch table will get updated when there is a reply from the destination node.
2. If ARP Protocol isn't running (Static ARP Enabled),
- If TCP is running in the source node, the source sends TCP SYN to the switch, which updates its table and broadcasts the TCP SYN packet to all the nodes except the source node.
- The switch table will get updated when there is a TCP SYN ACK from the destination node.
3. If ARP Protocol isn't running (Static ARP Enabled),
- If UDP is the transport layer protocol, the source node starts sending the data packets to the Switch.
- Switch will keep broadcasting packets to all nodes except the source node, as there will not be any packets from the destination node. This will continue till the destination identity gets updated in the switch table.