View the MAC Address Table on a Cisco Switch

Posted May 27, 2004 by Quinn McHenry in Cisco switch

Switches maintain a database of MAC addresses, both manually configured (static) and dynamically learned entries. During troubleshooting, it may be helpful to investigate the entries in the MAC table.

To view the whole MAC table, use the following command from enable mode:

show mac-address-table

To list only the dynamically learned entries in the MAC table, use the following:

show mac-address-table dynamic


About Quinn McHenry

Quinn was one of the original co-founders of Tech-Recipes. He is currently crafting iOS applications as a senior developer at Small Planet Digital in Brooklyn, New York.
View more articles by Quinn McHenry

The Conversation

Follow the reactions below and share your own thoughts.

  • Mike Sherman

    show mac-address-table vlan 123

  • 0zK4Rr

    sh mac address-table dynamic | exc Gi0/23|Gi0/24
    *** Gi0/23 Gi0/24 puertos de cascadas

    sh mac-address-table interface Fa0/7
    *** MAC del puerto Fa0/7

  • Anonymous

    On an old 5500:

    Usage: show cam [count] [vlan]
    show cam
    show cam [vlan]
    show cam agingtime
    show cam mlsrp [vlan]

    • Martin S.

      > “On an old 5500:”

      … or on any other old Catalyst switch that runs CatOS.

  • Anonymous

    show interface serial 0/0

    • Martin S.

      “sh mac-addr” displays the Layer-2 switching table, i.e. how which path Ethernet packet take through the switch. “show interface …” has nothing to do with that.

  • vikram singh

    to check the sequence or in how many stages your network work just type tracert web site name ( and you find theful path of your metwork and web site..

    • Martin S.


      Both the “ping” and the “traceroute” command are Layer-3 commands: they have to do with how IP packets are routed across an internet (i.e. a network of local area networks and point-to-point connections that are interconnected by routers). The Internet is one such internet ;-). They have nothing to do with the MAC-table (or Switching Table) on a Layer-2 switch.

      What “sh mac-addr” (or “show cam” on CatOS) displays is switching information within a local area network (LAN). The command is often used in corporate environments when questions arise such as “We can see that node is infected with a virus – can you tell me which port it is connected to, so that I can disable the port and then follow the cable, find the workstation and clean it out?” In that scenario, you would issue these commands:

      On the router that connects the LAN to the bigger world:

      router# sh ip arp
      Protocol Address Age (min) Hardware Addr Type Interface
      Internet 0 0811.96c0.78b8 ARPA Vlan100

      and then find out where that hardware address is sent to on the switch to which the router is connected (if it’s a “Layer-3 switch”, this can be the same device):

      switch# sh mac-addr address 0811.96c0.78b8
      Vlan Mac Address Type Ports
      —- ———– ——– —–
      100 0811.96c0.78b8 DYNAMIC Fa4/0/3

      Now you know that your culprit is plugged into port FastEthernet4/0/3 (unless that port goes to another switch, in which case you need to repeat the “show mac-a” command on that other switch).

  • vikram singh

    A powerful command to trace your network or to check the connectivity in your network that is PING command (Packet InterNet Gopher) tracert command always shows full information from source to destination but ping shows only if the network is working or not means yes or no for example (Tracert lists the places that a message passes from source to destination. Ping only says the computer destination is answering “yes, I’m here.” Traceroute is like when you are making directions for friends to come to your house as you ride the route – “Turn right on 5th, left on 10th, 640 north, left on highway 251” Ping is a phone call where the other person picks up and says “I’m home” then hangs up. )