I have a relatively dumb question. Suppose the Switch just started, and it received a frame that contains a destination MAC address for a network device not in its MAC addresses table.
What happens then? Does it broadcast (MAC address ff:ff:ff:ff:ff:ff) and receive answers from connected devices, or is there a protocol dedicated for that which is used? I don't think the switch uses the ARP (Address Resolution Protocol)?
Good question. I'll answer it with an animation:
When Host A sends the frame, the switch does not have anything in its MAC address table. Upon receiving the frame, it records Host A's MAC Address to Switch Port mapping. Since it doesn't know where the destination MAC address is, it floods the frame out all ports.
This assures that if host B exists (which at this point, the switch does not know yet), that it will receive it. Hopefully, upon receiving the frame, Host B will generate a response frame, which will allow the Switch to learn the MAC address mapping from the return frame.
You can read more about how a Switch works here (where I took the animation from). I would also suggest reading the entire article series for a closer look at how a packet moves through a network.
One last note regarding the terms Flooding vs Broadcast. A switch never broadcasts frames, a broadcast is not an action a switch can take. A switch can only flood a frame. A broadcast is simply a frame with a destination MAC address of ffff.ffff.ffff. This is often confused because the end effect is the same, but they are actually different.
The switch doesn't use ARP, but ARP can help in preventing this situation from occurring in the first place, for two reasons:
If node A is sending an IP packet to node B which isn't in its ARP cache, it will first send an ARP request (which is a broadcast packet, and will automatically be flooded to all ports by the switch). When node B sends its ARP reply, the switch will learn its MAC address. So, by the time actual data transfer happens, the switch already knows the MAC addresses of the participants, and doesn't need to flood data packets.
Many devices, when their link goes up, will send a gratuitous ARP packet. In addition to updating the ARP caches of other nodes on the network, the GARP will also fill the switch's MAC address table.
IPv6 doesn't use ARP, but NDP fulfills a similar purpose.
So overall, although switches certainly will flood frames to unicast addresses they haven't learned, it's not necessary as often as you might think, because it will usually have the opportunity to learn nodes' addresses from broadcast frames beforehand. However, you can definitely observe it with a switch that's had its MAC table overflowed or that has just rebooted.
When a switch receives a frame, it updates its MAC address table with the source MAC address and the port on which it received the frame. If the destination MAC address isn't in its MAC address table (unknown unicast), it floods the frame to all ports, except the port on which the frame was received.
