What are the two steps of the switch "Learn and Forward" method?

Step 1: Learn the source MAC (Media Access Control) address. Step 2: Forward based on the destination MAC address.

* The two-step Learn-and-Forward process. *

A MAC address (Media Access Control address) is the unique 48-bit hardware address burned into every network interface (e.g. 00:1A:2B:3C:4D:5E) — it's how a switch identifies which physical device is on which port, operating at Layer 2 (the data link layer).

This two-step process happens for every frame a switch receives:

Step 1 — Learn (examine source address):

• If the source MAC is not in the table → add it with the ingress port number
• If the source MAC is in the table → reset the aging timer back to 5 minutes
• If the source MAC is in the table but on a different port → update the port (the device moved)

Step 2 — Forward (examine destination address):

• If the destination MAC is in the table → forward out that specific port only (unicast)
• If the destination MAC is not in the table → flood the frame out all ports except the ingress port (unknown unicast flooding)
• If the destination is a broadcast (FF:FF:FF:FF:FF:FF) → flood out all ports except ingress

This is why the first frame to a new destination is always flooded — the switch hasn't learned where the destination lives yet.

Go deeper:

• Host to Host through a Switch (PracticalNetworking) — frame-by-frame walkthrough of source-MAC learning then unicast-or-flood.
• MAC address (Wikipedia) — the 48-bit L2 address the switch keys on, including the unicast/multicast bit.