How does MAC learning function?

A switch only overwrites a known MAC address in its table if that MAC address is subsequently learned on a *different* port, indicating the device has moved, not simply if it's known.

MAC address learning is a core, default behavior of Ethernet switches, where the switch automatically builds its MAC address table by inspecting the source MAC address of incoming frames on all active interfaces within a VLAN, enabling efficient forwarding decisions.

While some MAC-related features like port security contribute to network security, MAC learning itself is primarily a forwarding mechanism and does not directly protect against denial-of-service attacks.

CDP (Cisco Discovery Protocol) is a Layer 2 protocol for discovering directly connected Cisco devices, and it is unrelated to how a switch forwards data frames based on MAC addresses.