View the MAC Address Table on a Cisco Switch

Switches maintain a database of MAC addresses, both manually configured (static) and dynamically learned entries. During troubleshooting, it may be helpful to investigate the entries in the MAC table.


To view the whole MAC table, use the following command from enable mode:

show mac-address-table

To list only the dynamically learned entries in the MAC table, use the following:

show mac-address-table dynamic

 

About Quinn McHenry

Quinn was one of the original co-founders of Tech-Recipes. He is currently crafting iOS applications as a senior developer at Small Planet Digital in Brooklyn, New York.
View more articles by Quinn McHenry

The Conversation

Follow the reactions below and share your own thoughts.

9 Responses to “View the MAC Address Table on a Cisco Switch”

  1. April 01, 2009 at 2:43 pm, Mike Sherman said:

    show mac-address-table vlan 123

    Reply

  2. September 09, 2009 at 4:46 am, 0zK4Rr said:

    sh mac address-table dynamic | exc Gi0/23|Gi0/24
    *** Gi0/23 Gi0/24 puertos de cascadas

    sh mac-address-table interface Fa0/7
    *** MAC del puerto Fa0/7

    Reply

  3. September 17, 2009 at 2:04 pm, Anonymous said:

    On an old 5500:

    Usage: show cam [count] [vlan]
    show cam
    show cam [vlan]
    show cam agingtime
    show cam mlsrp [vlan]

    Reply

    • September 28, 2012 at 8:44 am, Martin S. said:

      > “On an old 5500:”

      … or on any other old Catalyst switch that runs CatOS.

      Reply

  4. December 05, 2009 at 9:02 pm, Anonymous said:

    show interface serial 0/0

    Reply

    • September 28, 2012 at 8:47 am, Martin S. said:

      “sh mac-addr” displays the Layer-2 switching table, i.e. how which path Ethernet packet take through the switch. “show interface …” has nothing to do with that.

      Reply

  5. May 23, 2010 at 9:21 pm, vikram singh said:

    to check the sequence or in how many stages your network work just type tracert web site name (google.com) and you find theful path of your metwork and web site..

    Reply

    • September 28, 2012 at 9:04 am, Martin S. said:

      Vikram,

      Both the “ping” and the “traceroute” command are Layer-3 commands: they have to do with how IP packets are routed across an internet (i.e. a network of local area networks and point-to-point connections that are interconnected by routers). The Internet is one such internet ;-) . They have nothing to do with the MAC-table (or Switching Table) on a Layer-2 switch.

      What “sh mac-addr” (or “show cam” on CatOS) displays is switching information within a local area network (LAN). The command is often used in corporate environments when questions arise such as “We can see that node 10.1.100.15 is infected with a virus – can you tell me which port it is connected to, so that I can disable the port and then follow the cable, find the workstation and clean it out?” In that scenario, you would issue these commands:

      On the router that connects the LAN to the bigger world:

      router# sh ip arp 10.1.100.15
      Protocol Address Age (min) Hardware Addr Type Interface
      Internet 10.1.100.15 0 0811.96c0.78b8 ARPA Vlan100

      and then find out where that hardware address is sent to on the switch to which the router is connected (if it’s a “Layer-3 switch”, this can be the same device):

      switch# sh mac-addr address 0811.96c0.78b8
      Vlan Mac Address Type Ports
      —- ———– ——– —–
      100 0811.96c0.78b8 DYNAMIC Fa4/0/3

      Now you know that your culprit is plugged into port FastEthernet4/0/3 (unless that port goes to another switch, in which case you need to repeat the “show mac-a” command on that other switch).

      Reply

  6. May 23, 2010 at 9:39 pm, vikram singh said:

    A powerful command to trace your network or to check the connectivity in your network that is PING command (Packet InterNet Gopher) tracert command always shows full information from source to destination but ping shows only if the network is working or not means yes or no for example (Tracert lists the places that a message passes from source to destination. Ping only says the computer destination is answering “yes, I’m here.” Traceroute is like when you are making directions for friends to come to your house as you ride the route – “Turn right on 5th, left on 10th, 640 north, left on highway 251″ Ping is a phone call where the other person picks up and says “I’m home” then hangs up. )

    Reply

Leave a Reply