In which configuration mode is show mac address-table used?

The show mac address-table command is entered in Privileged EXEC mode on Cisco IOS devices.

Layer 2Privileged EXEC

show mac address-table

Displays the MAC address table (also known as CAM table) on a switch, showing which MAC addresses are learned on which VLAN and port, used to verify Layer 2 forwarding and detect issues like MAC flooding or incorrect port assignments.

Definition: show mac address-table is a Cisco IOS privileged exec command. Displays the MAC address table (also known as CAM table) on a switch, showing which MAC addresses are learned on which VLAN and port, used to verify Layer 2 forwarding and detect issues like MAC flooding or incorrect port assignments.

Overview

The 'show mac address-table' command is one of the most fundamental Layer 2 troubleshooting and verification tools on Cisco switches. It displays the MAC address table—also known as the Content Addressable Memory (CAM) table—which the switch uses to make forwarding decisions. When a frame arrives on a switch port, the switch examines the source MAC address and associates it with the incoming port and VLAN, storing this information in the MAC address table.

For subsequent frames destined to that MAC address, the switch forwards them only out of the correct port, rather than flooding them to all ports. This command is essential for verifying that MAC addresses are being learned correctly, confirming which devices are connected to which ports, and detecting issues such as MAC flooding attacks, duplicate MAC addresses, or misconfigured port security. Unlike 'show arp' which maps IP to MAC addresses, 'show mac address-table' focuses purely on Layer 2 forwarding.

It is often the first command used when troubleshooting connectivity issues at Layer 2, such as when a host cannot reach the default gateway or when traffic is not being forwarded as expected. The command is available in privileged EXEC mode (enable) and does not require any additional privilege levels. It does not affect the running configuration; it is a read-only diagnostic command.

On larger switches with many MAC entries, the output can be extensive, and the command supports filtering by VLAN, interface, MAC address, and address type (static, dynamic, secure). Understanding the output is critical for CCNA and CCNP candidates, as it directly relates to switching concepts like VLANs, trunking, and STP. The command also helps in verifying the operation of features like port security, sticky MAC, and MAC address aging.

In a typical workflow, after configuring VLANs and assigning ports, an engineer would use 'show mac address-table' to confirm that hosts are learning the correct MAC addresses on the expected VLANs and ports. If a host is not receiving traffic, checking the MAC table can reveal whether the destination MAC address is present and on which port it is learned. The command also helps in identifying loops: if the same MAC address appears on multiple ports (especially in the same VLAN), it may indicate a bridging loop or misconfiguration.

The output is buffered and can be paginated using the 'more' prompt; to disable pagination, use 'terminal length 0' before the command. Overall, 'show mac address-table' is a cornerstone of Layer 2 verification and troubleshooting, and mastering its output is essential for any network engineer working with Cisco switches.

Syntax·Privileged EXEC

show mac address-table

When to Use This Command

Verify which port a specific device (e.g., a server at 192.168.1.100) is connected to by checking its MAC address.
Troubleshoot connectivity issues by confirming that MAC addresses are learned on the expected VLAN and port.
Detect potential MAC flooding attacks by looking for an unusually high number of dynamic MAC entries on a single port.
Check for stale or incorrect MAC entries after a topology change (e.g., moving a cable to a different port).

Parameters

Parameter	Syntax	Required	Description
vlan	vlan <1-4094>	Optional	Displays MAC addresses learned only in the specified VLAN. Valid values are VLAN IDs from 1 to 4094. A common mistake is forgetting that VLAN 1 is the default VLAN; if you filter by VLAN 1, you may see many addresses. Use this parameter to narrow down the output to a specific VLAN for easier analysis.
interface	interface <interface-type> <interface-number>	Optional	Displays MAC addresses learned on a specific interface, such as GigabitEthernet0/1. The interface must be specified in the format (e.g., GigabitEthernet0/1, FastEthernet0/1). A common mistake is using the wrong interface type or number, leading to no output. This parameter is useful for verifying which MAC addresses are behind a particular port.
address	address <mac-address>	Optional	Displays information for a specific MAC address, entered in dotted-triple format (e.g., aaaa.bbbb.cccc). This is useful for tracking a particular device's MAC address in the table. A common mistake is using incorrect formatting (e.g., colons instead of dots) or an incomplete address. The MAC address must be exactly 12 hexadecimal characters.
dynamic	dynamic	Optional	Displays only dynamically learned MAC addresses, excluding static and secure entries. This is the most common type of entry. Use this parameter to see which MAC addresses have been learned via normal switching operations. No additional values are needed.
static	static	Optional	Displays only statically configured MAC addresses. These are manually entered using the 'mac address-table static' command. Use this parameter to verify static MAC entries, which are often used for security or to assign a specific MAC to a port.
secure	secure	Optional	Displays only secure MAC addresses, which are learned via port security with the 'sticky' option or configured as secure. This parameter helps verify port security configurations. A common mistake is confusing secure addresses with dynamic addresses; secure addresses are stored in the running config.
count	count	Optional	Displays the total number of MAC addresses in the table, broken down by type (dynamic, static, secure). This is useful for quickly assessing the size of the MAC table without viewing all entries. No additional values are needed.

Command Examples

Basic MAC Address Table Display

show mac address-table

          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0050.7966.6800    DYNAMIC     Gi0/1
   1    0050.7966.6801    DYNAMIC     Gi0/2
  10    00a1.b2c3.d4e5    STATIC      Gi0/3
  10    aaaa.bbbb.cccc    DYNAMIC     Gi0/4
Total Mac Addresses for this criterion: 4

Line 1: Header. Line 2: Dashed separator. Line 3: Column headers: Vlan (VLAN ID), Mac Address (MAC in dotted hex), Type (DYNAMIC, STATIC, or other), Ports (interface). Lines 4-7: Each entry shows VLAN 1 has two dynamic MACs on Gi0/1 and Gi0/2; VLAN 10 has a static MAC on Gi0/3 and a dynamic MAC on Gi0/4. Last line: Total count of MAC addresses displayed.

Display MAC Address Table for a Specific VLAN

show mac address-table vlan 10

          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    00a1.b2c3.d4e5    STATIC      Gi0/3
  10    aaaa.bbbb.cccc    DYNAMIC     Gi0/4
Total Mac Addresses for this criterion: 2

Same format but filtered to VLAN 10 only. Useful to focus on a specific VLAN's forwarding table.

Understanding the Output

The output shows the MAC address table, which is the core forwarding table for Layer 2 switching. The 'Vlan' column indicates the VLAN in which the MAC address was learned or configured. The 'Mac Address' column displays the 48-bit MAC address in dotted hexadecimal format (e.g., 0050.7966.6800).

The 'Type' column indicates how the entry was learned: 'DYNAMIC' means the switch learned it from incoming frames, 'STATIC' means it was manually configured, and other types like 'SECURE' or 'STICKY' may appear in port security contexts. The 'Ports' column shows the outgoing interface (e.g., Gi0/1) for frames destined to that MAC address. In a healthy network, you expect dynamic entries to match the actual device connections; a sudden increase in dynamic entries on a single port may indicate a MAC flooding attack.

Static entries are typically used for servers or routers. Empty tables or missing expected entries suggest a Layer 2 issue (e.g., VLAN mismatch, cable problem). The total count at the bottom helps quickly assess table size.

Configuration Scenarios

Verify MAC Address Learning on an Access Port

A network administrator has configured VLAN 10 on a switch and assigned interface GigabitEthernet0/1 to VLAN 10. They need to verify that a connected PC is being learned correctly on that port and VLAN.

Topology

PC1---(Gi0/1)SW1

Steps

1.Step 1: Connect to the switch via console or SSH and enter privileged EXEC mode: SW1> enable
2.Step 2: Display the MAC address table for VLAN 10: SW1# show mac address-table vlan 10
3.Step 3: Look for the PC's MAC address (e.g., aaaa.bbbb.cccc) in the output. Verify that the MAC address appears under VLAN 10 and interface GigabitEthernet0/1.
4.Step 4: If the MAC address is not present, check the PC's connectivity (cable, NIC status) and ensure the port is not err-disabled.

Configuration

! No configuration is required for dynamic MAC learning; the switch learns automatically.
! However, ensure the interface is in VLAN 10:
interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
!

Verify: SW1# show mac address-table vlan 10 Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 10 aaaa.bbbb.cccc DYNAMIC Gi0/1 Total Mac Addresses for this criterion: 1

Watch out: If the PC is sending traffic with a different source MAC (e.g., due to a virtual NIC), the expected MAC may not appear. Always verify the actual MAC address of the PC using 'ipconfig /all' (Windows) or 'ifconfig' (Linux/Mac).

Troubleshoot a Duplicate MAC Address Across Ports

A network engineer suspects a Layer 2 loop or a misconfiguration because the same MAC address appears on two different ports in the same VLAN. This scenario demonstrates how to identify and resolve the issue.

Topology

SW1---(Gi0/1)---PC1
SW1---(Gi0/2)---(accidental loop or misconfig)

Steps

1.Step 1: Enter privileged EXEC mode: SW1> enable
2.Step 2: Display the MAC address table for the suspect MAC address: SW1# show mac address-table address aaaa.bbbb.cccc
3.Step 3: Observe if the MAC address appears on multiple ports (e.g., Gi0/1 and Gi0/2) in the same VLAN. This indicates a problem.
4.Step 4: Check for physical loops or misconfigurations. If the MAC is on two ports, one might be a redundant link without STP, or a host might be connected to two ports (e.g., bridging).
5.Step 5: Use 'show spanning-tree' to verify STP state. If one port is in blocking mode, the duplicate may be transient. If both are forwarding, there is a loop.
6.Step 6: Resolve by correcting cabling, enabling STP, or configuring port security to limit MAC addresses per port.

Configuration

! To prevent duplicate MAC issues, enable port security to limit MAC addresses per port:
interface GigabitEthernet0/2
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown
!

Verify: SW1# show mac address-table address aaaa.bbbb.cccc Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 10 aaaa.bbbb.cccc DYNAMIC Gi0/1 10 aaaa.bbbb.cccc DYNAMIC Gi0/2 ! This output indicates a problem. After correction, the MAC should appear on only one port.

Watch out: A duplicate MAC address can also occur if a virtual machine with the same MAC is connected to two different ports. Always verify the actual device configuration.

Troubleshooting with This Command

When troubleshooting Layer 2 issues, 'show mac address-table' is often the first command to run. A healthy MAC address table shows each MAC address appearing exactly once per VLAN, on the correct port. For example, a PC connected to Gi0/1 in VLAN 10 should have its MAC address listed with type DYNAMIC and port Gi0/1.

If the MAC address is missing, the switch has not learned it, which could be due to a faulty cable, the PC not sending traffic, or the port being in a blocking state (e.g., STP). If the MAC address appears on the wrong port, traffic may be misdirected, often due to a misconfigured trunk or a bridging loop. One of the most critical indicators of a problem is when the same MAC address appears on multiple ports in the same VLAN.

This typically indicates a Layer 2 loop—the switch is learning the same source MAC from two different paths. In such cases, Spanning Tree Protocol (STP) should be blocking one of the ports; if both ports are forwarding, STP may be disabled or malfunctioning. Another common symptom is a MAC address that constantly moves between ports (flapping), which can be seen in the log as 'mac address-table move' notifications.

This often points to a loop or a host with multiple connections. To diagnose, start by checking the MAC table for the specific MAC address using 'show mac address-table address <mac>'. If the MAC is missing, verify that the host is sending traffic (ping the gateway) and check the interface status with 'show interfaces status'.

If the MAC is present but on the wrong port, check the VLAN configuration and trunk settings. Use 'show interfaces trunk' to see which VLANs are allowed on trunk ports. If you see the same MAC on multiple ports, immediately check STP with 'show spanning-tree vlan <vlan>'.

Look for ports in the forwarding state that should be blocking. Also, check for any port-channel configurations that might be misbehaving. Correlate the MAC table with 'show arp' to map IP to MAC addresses, which helps identify the device.

For example, if a host's IP is known but its MAC is not in the table, the issue is at Layer 2. If the MAC is in the table but ARP fails, the issue may be at Layer 3. Additionally, 'show mac address-table count' gives a quick overview of the number of dynamic, static, and secure entries.

A sudden spike in dynamic entries could indicate a MAC flooding attack. In summary, a systematic approach: 1) Check the MAC table for the specific MAC. 2) Verify interface status and VLAN. 3) Check for duplicate MACs or flapping. 4) Examine STP state. 5) Correlate with ARP and interface counters. This command is indispensable for isolating Layer 2 problems quickly.

CCNA Exam Tips

CCNA exam tip: Know that the MAC address table is also called the CAM table; the command 'show mac address-table' is the modern syntax, but older IOS may use 'show mac-address-table'.

CCNA exam tip: Dynamic entries age out by default after 300 seconds (5 minutes); you can verify this with 'show mac address-table aging-time'.

CCNA exam tip: A common exam scenario: after moving a PC from port Gi0/1 to Gi0/2, the MAC address may still appear on the old port until the aging timer expires or you clear the table with 'clear mac address-table dynamic'.

CCNA exam tip: Be able to distinguish between dynamic, static, and secure MAC addresses; secure MACs are configured with port security and appear as 'SECURE' or 'STICKY'.

Common Mistakes

Mistake: Confusing the MAC address table with the ARP table; the MAC table is Layer 2 (switch), ARP is Layer 3 (router).

Mistake: Forgetting that the MAC address table only shows entries for the local switch; it does not show MAC addresses of devices on other switches unless they are in the same VLAN and the switch has learned them.

Mistake: Assuming a static MAC entry guarantees connectivity; if the port is down or the device is disconnected, the entry remains but traffic will fail.

show mac address-table vs clear mac address-table dynamic

Both commands operate on the switch's MAC address table, but serve opposite purposes: one displays the table contents for verification, while the other clears dynamically learned entries to reset Layer 2 learning. They are frequently used together during troubleshooting to inspect and then reset MAC learning.

Aspect	show mac address-table	clear mac address-table dynamic
Function	Displays MAC address table	Deletes dynamic MAC address entries
Data Types Affected	Reads static, dynamic, and secure entries	Removes only dynamic entries; static and secure left intact
Operational Impact	None; read-only	Causes temporary flooding of unknown unicast frames until addresses are re-learned
Typical Use Case	Verify MAC learning and port assignments	Reset MAC learning after topology change or security event
Entry Persistence	Entries persist unless aged out or manually cleared	Immediately removes dynamic entries; aging timers unaffected

Use show mac address-table when you need to inspect which MAC addresses are learned on which VLAN and port, for example to verify correct MAC learning or troubleshoot connectivity issues.

Use clear mac address-table dynamic when you want to force the switch to re-learn all MAC addresses, such as after a topology change or to clear a potentially compromised table.

Platform Notes

On IOS-XE (e.g., Catalyst 3650/3850/9300), the command syntax is identical to classic IOS: 'show mac address-table'. However, the output format may differ slightly, with additional columns like 'Type' and 'Ports' displayed differently. On NX-OS (e.g., Nexus 9000), the equivalent command is 'show mac address-table' as well, but the syntax for filtering is different.

For example, to display the MAC table for a specific VLAN on NX-OS, use 'show mac address-table vlan <vlan-id>'. NX-OS also supports 'show mac address-table count' and 'show mac address-table dynamic'. On Cisco ASA firewalls, the MAC address table is not typically used for Layer 2 switching; instead, the ASA uses a 'show mac-address-table' command in certain contexts (e.g., transparent firewall mode), but it is not a primary command.

On IOS-XR (e.g., ASR 9000), the command is 'show mac address-table' but with different output formatting and parameters. For example, on IOS-XR, you might use 'show mac address-table location <node-id>' to specify a line card. In terms of IOS versions, the command has remained largely consistent from 12.x through 16.x, but newer versions may include additional fields like 'Age' or 'Flags'.

Always check the specific platform documentation for exact syntax. On older IOS (12.x), the command was 'show mac-address-table' (with a hyphen), but this is deprecated in favor of 'show mac address-table'. On Catalyst switches running IOS-XE, the command is the same as classic IOS.

For CCNA/CCNP studies, the classic IOS syntax is used, but candidates should be aware of these platform differences for real-world scenarios.

Related Commands

clear mac address-table dynamic

Clears all dynamically learned MAC address entries from the MAC address table, forcing the switch to relearn MAC addresses on interfaces.

show mac address-table dynamic

Displays the dynamically learned MAC address table entries on a switch, used to verify which devices are learned on which ports and VLANs.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions