Why does a switch with an incomplete mac address table - sends a broadcast when it receives a frame with an unknown mac address?

Question

Wont it make more sense in term of less congestion to send a multicast to just those interfaces that are not currently in its mac table?

Answer 1

No, any interface could be connected to a neighboring hub/switch having more than one MAC address on it. Therefore, unknown unicast traffic is flooded to all ports except the origin port.

Answer 2

It wouldn't be ideal if the switch sends multicast to interfaces not currently in its switching table. The ideal thing is for the switch to flood the unknown unicast frame out all interfaces except the port on which the frame came from. The primary reason for this is that hosts might have been moved around or replaced with other hosts. Consider this, if for example in a switch's CAM table there are entries for Port F0/1 and F0/2 with Mac-addresses of 00:BB:CC:FF:11:22 and 11:33:CC:DD:22::FF respectively (host A and host B).

Supposing the network administrator removed host A from interface F0/1 to interface F0/3 and replaced interface F0/1 with host C (Mac-address 11:22:33:AA:CC:00), the switch would be ignorant of this change. Supposing the switch received a frame with destination Mac-address of 11:22:33:AA:CC:00, it would be making a grave mistake by sending a multicast out all other franes except the ones already in its table.

But when the switch floods the unknown unicast out all its interfaces (except the port on which it came from), it would learn that host A has moved from port F0/1 and that port F0/1 has been effectively replaced with host C. The switch then updates this entry in its CAM table. So as you can see, multicast frames will not be ideal in this situation.

PS. CAM table, Mac-address table, switching table etc etc all mean the same. I used the terms 'interface' and 'ports' interchangeably.