In which configuration mode is clear mac address-table dynamic used?

The clear mac address-table dynamic command is entered in Privileged EXEC mode on Cisco IOS devices.

Layer 2Privileged EXEC

clear mac address-table dynamic

Clears all dynamically learned MAC address entries from the MAC address table, forcing the switch to relearn MAC addresses on interfaces.

Definition: clear mac address-table dynamic is a Cisco IOS privileged exec command. Clears all dynamically learned MAC address entries from the MAC address table, forcing the switch to relearn MAC addresses on interfaces.

Overview

The `clear mac address-table dynamic` command is a powerful troubleshooting tool used in Cisco IOS to remove all dynamically learned MAC address entries from the switch's MAC address table. The MAC address table, also known as the Content Addressable Memory (CAM) table, is a fundamental component of Layer 2 switching. It maps MAC addresses to the specific switch ports through which they are reachable, enabling the switch to forward frames efficiently without flooding them out all ports.

Dynamic entries are learned by examining the source MAC address of incoming frames and are aged out after a period of inactivity (default 300 seconds). However, there are scenarios where an engineer needs to force an immediate refresh of the table, such as after a topology change (e.g., a link failure or a new device connected), when troubleshooting connectivity issues caused by stale entries, or when testing the convergence of Spanning Tree Protocol (STP). This command clears only dynamic entries; static and secure MAC addresses remain untouched.

It does not affect the running configuration, as dynamic entries are not stored in NVRAM. The command requires privileged EXEC mode (enable level 15 or equivalent). It is important to note that clearing the table can cause temporary flooding of unicast frames to all ports until the switch relearns the MAC addresses, which may impact network performance momentarily.

This command is often used in conjunction with `show mac address-table` to verify the current state and after clearing to confirm the table is empty. Alternatives include clearing specific entries with `clear mac address-table dynamic address <mac>` or clearing entries on a specific interface with `clear mac address-table dynamic interface <interface>`. The `clear mac address-table dynamic` command is a quick and effective way to reset the learning process without disrupting the switch's operation or requiring a reload.

It is commonly used in network troubleshooting workflows when investigating issues like unicast flooding, incorrect forwarding, or after making changes to VLAN configurations or STP priorities. Understanding the behavior of this command is crucial for CCNA and CCNP candidates, as it appears in both exam topics and real-world scenarios. The command is supported on most Cisco Catalyst switches running IOS, IOS-XE, and even some NX-OS platforms (with slight syntax differences).

It is a low-risk operation but should be used judiciously in production environments to avoid unnecessary flooding.

Syntax·Privileged EXEC

clear mac address-table dynamic

When to Use This Command

After a network topology change (e.g., a new switch or link added) to force the switch to relearn MAC addresses and avoid stale entries.
When troubleshooting connectivity issues caused by incorrect MAC address entries in the table.
Before performing a failover test in a redundant network to ensure the MAC table reflects the active paths.
When a security incident is suspected and you want to clear dynamic entries to prevent potential MAC spoofing attacks.

Command Examples

Clear all dynamic MAC addresses

clear mac address-table dynamic

Switch#clear mac address-table dynamic
Switch#

No output is displayed upon successful execution. The command simply clears all dynamic entries and returns to the prompt.

Clear dynamic MAC addresses on a specific interface

clear mac address-table dynamic interface gigabitethernet 0/1

Switch#clear mac address-table dynamic interface gigabitethernet 0/1
Switch#

This variant clears only the dynamic MAC entries learned on GigabitEthernet0/1. Useful for targeting a specific port without affecting other interfaces.

Understanding the Output

The 'clear mac address-table dynamic' command does not produce any output upon success. It silently clears all dynamically learned MAC addresses from the MAC address table. To verify the effect, you must use the 'show mac address-table dynamic' command before and after.

After clearing, the table will show no dynamic entries until the switch relearns them. This command does not affect static or secure MAC addresses. In a production network, clearing the MAC table can cause temporary flooding of frames to all ports until addresses are relearned, which may impact performance briefly.

Configuration Scenarios

Clearing MAC Table After a Network Topology Change

After a link failure and recovery, the switch may have stale MAC entries pointing to the old port. Clearing the dynamic entries forces the switch to relearn MAC addresses on the correct interfaces, ensuring optimal forwarding.

Topology

Switch1(Gi0/1)---PC-A
Switch1(Gi0/2)---PC-B
Switch1(Gi0/3)---Switch2

Steps

1.Step 1: Enter privileged EXEC mode: Switch> enable
2.Step 2: Verify current MAC table: Switch# show mac address-table dynamic
3.Step 3: Clear all dynamic entries: Switch# clear mac address-table dynamic
4.Step 4: Verify the table is empty: Switch# show mac address-table dynamic
5.Step 5: Allow traffic to flow and verify relearned entries: Switch# show mac address-table dynamic

Configuration

! No configuration changes are made; this is an exec command.
Switch# clear mac address-table dynamic

Verify: Switch# show mac address-table dynamic (Output should show no entries after clearing, then entries reappear as traffic flows.)

Watch out: Clearing the MAC table can cause temporary flooding of unicast frames, which may impact performance. Ensure this is done during a maintenance window if possible.

Troubleshooting Unicast Flooding Due to Stale MAC Entries

A user reports slow network performance. The switch may be flooding unicast frames because it has a stale MAC entry pointing to a port that no longer has the device. Clearing the dynamic table forces the switch to relearn the correct port.

Topology

Switch1(Gi0/1)---Server
Switch1(Gi0/2)---Client
Switch1(Gi0/3)---Router

Steps

1.Step 1: Enter privileged EXEC mode: Switch> enable
2.Step 2: Check for high unicast flooding: Switch# show interfaces Gi0/1 counters errors (look for excessive output drops or runts)
3.Step 3: View current MAC table: Switch# show mac address-table dynamic
4.Step 4: Clear the dynamic entries: Switch# clear mac address-table dynamic
5.Step 5: Monitor the MAC table as traffic flows: Switch# show mac address-table dynamic
6.Step 6: Verify that the flooding issue is resolved by checking interface counters again.

Configuration

! No configuration changes; exec command only.
Switch# clear mac address-table dynamic

Verify: Switch# show mac address-table dynamic (After clearing, the table should be empty. After traffic, entries should appear with correct port mappings.)

Watch out: If the issue persists, the problem may be due to a loop or STP misconfiguration rather than stale MAC entries. Use 'show spanning-tree' to check for blocking ports.

Troubleshooting with This Command

The `clear mac address-table dynamic` command is a key troubleshooting tool for Layer 2 forwarding issues. When a switch forwards frames, it uses the MAC address table to determine the egress port. If the table contains incorrect or stale entries, frames may be sent to the wrong port, causing connectivity problems or unnecessary flooding.

Healthy output from `show mac address-table dynamic` shows entries with recent age timestamps and correct port mappings. Problem indicators include entries with very old ages (close to the default 300 seconds) that do not match the current topology, or entries pointing to ports that are down or in a blocking state. Common symptoms that this command helps diagnose include: 1) Unicast flooding: when a switch sends unicast frames out all ports because it cannot find the destination MAC in the table.

This can be observed by high output drops on interfaces or by using `show interfaces` counters. 2) Intermittent connectivity: a device may be reachable sometimes but not others if its MAC entry is bouncing between ports due to a loop or misconfiguration. 3) Slow network performance: excessive flooding consumes bandwidth. A step-by-step diagnostic flow: First, identify the symptom (e.g., a specific host cannot communicate). Second, check the MAC table with `show mac address-table dynamic address <host-mac>` to see which port the switch thinks the host is on.

If the port is incorrect or the entry is missing, clear the dynamic table with `clear mac address-table dynamic`. Third, generate traffic from the host (e.g., ping the default gateway) and immediately check the MAC table again to see if the entry is learned on the correct port. Fourth, if the problem recurs, look for loops (using `show spanning-tree`), check for port-security violations, or verify that the host is not connected to multiple ports (e.g., via a hub).

Correlate with other commands: `show mac address-table count` to see the total number of entries; `show interfaces` to check for errors; `debug mac address-table` (with caution) to see real-time learning events. In a production environment, clearing the MAC table is a low-risk step that can quickly resolve many Layer 2 issues, but it should be combined with other diagnostic commands to identify the root cause.

CCNA Exam Tips

CCNA exam tip: The 'clear mac address-table dynamic' command is executed in Privileged EXEC mode, not Global Configuration mode.

CCNA exam tip: This command only clears dynamic entries; static and secure MAC addresses remain untouched.

CCNA exam tip: Know that you can clear entries per interface or per VLAN using the 'interface' or 'vlan' keywords.

CCNA exam tip: After clearing, the switch will flood frames to all ports until the new MAC addresses are learned, which can cause temporary loops if STP is not properly configured.

Common Mistakes

Mistake 1: Using the command in Global Configuration mode instead of Privileged EXEC mode. The command will be rejected.

Mistake 2: Forgetting that this command clears all dynamic entries, which can cause a temporary flood of unknown unicast frames and potential performance issues.

Mistake 3: Assuming the command clears static or secure MAC addresses; it does not.

clear mac address-table dynamic vs show mac address-table

These two commands are commonly paired in network troubleshooting and maintenance: one clears dynamically learned MAC entries to force relearning, while the other displays the current MAC address table to verify the results or monitor Layer 2 forwarding.

Aspect	clear mac address-table dynamic	show mac address-table
Purpose	Clears all dynamically learned MAC entries	Displays MAC address table entries
Effect on switch	Removes dynamic entries; static and secure entries remain	No change; read-only operation
Output	No output on success (or brief confirmation)	Table showing VLAN, MAC address, port, type
Typical use	After topology changes or to clear stale entries	Verifying MAC learning, troubleshooting connectivity
Configuration mode	Privileged EXEC	Privileged EXEC (or user EXEC)
Persistence	Transient; entries are relearned	Shows current state (changes with traffic)

Use clear mac address-table dynamic when you need to force the switch to relearn MAC addresses after a topology change or to clear stale entries that might be causing forwarding issues.

Use show mac address-table when you need to inspect the current MAC forwarding table to verify correct learning, detect issues like MAC flooding, or confirm port assignments.

Platform Notes

On Cisco IOS-XE (e.g., Catalyst 3650, 9300), the command syntax is identical: `clear mac address-table dynamic`. The output format of `show mac address-table` may vary slightly, but the clear command works the same. On NX-OS (e.g., Nexus 9000), the equivalent command is `clear mac address-table dynamic` as well, but note that NX-OS uses the term 'MAC address table' and the command is available in privileged EXEC mode.

However, on some NX-OS platforms, you may need to specify the VLAN: `clear mac address-table dynamic vlan <vlan-id>`. The ASA firewall does not have a MAC address table in the same sense; it uses a MAC address table for transparent firewall mode, but the command is `clear mac-address-table` (note the hyphen). On IOS-XR (e.g., ASR 9000), the command is `clear mac address-table dynamic` but the syntax may require specifying the location or interface.

In general, the command is widely supported across Cisco platforms with minor variations. For IOS versions, the behavior is consistent from 12.x through 16.x. Always check the specific platform documentation for exact syntax.

Related Commands

show mac address-table

Displays the MAC address table (also known as CAM table) on a switch, showing which MAC addresses are learned on which VLAN and port, used to verify Layer 2 forwarding and detect issues like MAC flooding or incorrect port assignments.

show mac address-table dynamic

Displays the dynamically learned MAC address table entries on a switch, used to verify which devices are learned on which ports and VLANs.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions