show mac address-table dynamic
Displays the dynamically learned MAC address table entries on a switch, used to verify which devices are learned on which ports and VLANs.
Definition: show mac address-table dynamic is a Cisco IOS privileged exec command. Displays the dynamically learned MAC address table entries on a switch, used to verify which devices are learned on which ports and VLANs.
Overview
The 'show mac address-table dynamic' command is a fundamental Layer 2 troubleshooting and verification tool used on Cisco switches. It displays the dynamically learned MAC address entries in the switch's MAC address table, which maps MAC addresses to specific ports and VLANs. This command is essential for understanding which devices are connected to which switch ports and verifying that the switch is correctly learning MAC addresses via the bridging process.
The MAC address table is the core of a switch's forwarding logic: when a frame arrives, the switch looks up the destination MAC address in the table to determine the egress port. If the address is unknown, the switch floods the frame to all ports in the VLAN (except the ingress port). Dynamic entries are learned by examining the source MAC address of incoming frames and are aged out after a configurable time (default 300 seconds).
This command is typically used in scenarios such as verifying connectivity after a new device is connected, troubleshooting connectivity issues where a device is not reachable, checking for MAC address flapping (same MAC learned on multiple ports), or identifying unauthorized devices on the network. Alternatives include 'show mac address-table' (which shows all entries including static and secure), 'show mac address-table static' (for manually configured entries), and 'show mac address-table aging-time' (to check the aging timer). In a broader workflow, this command is often used after configuring VLANs or trunking, or when troubleshooting spanning-tree issues (e.g., verifying which port is root).
Important IOS behaviors: the output is paginated by default (use 'terminal length 0' to disable), the command requires privileged EXEC mode (enable), and it does not affect the running configuration. The output includes columns for VLAN, MAC address, type (DYNAMIC), and port. The command can be filtered by VLAN or interface using optional parameters.
Understanding this command is crucial for CCNA and CCNP candidates as it directly relates to switching fundamentals and troubleshooting methodologies.
show mac address-table dynamicWhen to Use This Command
- Verify that a specific host's MAC address has been learned on the correct switch port and VLAN.
- Troubleshoot connectivity issues by checking if MAC addresses are appearing on expected interfaces.
- Identify unauthorized devices connected to the network by reviewing unknown MAC addresses.
- Monitor MAC table aging and ensure entries are being refreshed properly.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| vlan | <1-4094> | Specifies a VLAN ID to filter the output to show only MAC addresses learned in that VLAN. Valid values are 1-4094 (standard VLAN range). Common mistake: using a VLAN that does not exist on the switch results in no output. |
| interface | interface-type interface-number | Specifies an interface (e.g., GigabitEthernet0/1) to filter the output to show only MAC addresses learned on that port. Common mistake: using an incorrect interface name or number (e.g., 'G0/1' instead of 'GigabitEthernet0/1') results in an error. |
Command Examples
Basic dynamic MAC address table display
show mac address-table dynamicMac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 1 0050.7966.6800 DYNAMIC Gi0/1 10 0011.2233.4455 DYNAMIC Gi0/2 10 00a0.c9b1.d2e3 DYNAMIC Gi0/3 20 0c75.bd0a.1234 DYNAMIC Gi0/4 Total Mac Addresses for this criterion: 4
Vlan: VLAN ID where the MAC was learned. Mac Address: MAC address in dotted-hex format. Type: Always DYNAMIC for this command. Ports: Switch port where the MAC was learned. Total count shows number of dynamic entries.
Filter by VLAN
show mac address-table dynamic vlan 10Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 10 0011.2233.4455 DYNAMIC Gi0/2 10 00a0.c9b1.d2e3 DYNAMIC Gi0/3 Total Mac Addresses for this criterion: 2
Filters output to only show dynamic MAC addresses learned in VLAN 10. Useful for isolating traffic in a specific VLAN.
Understanding the Output
The output displays a table with columns: Vlan (VLAN ID), Mac Address (48-bit MAC in dotted hex), Type (always DYNAMIC for this command), and Ports (interface where MAC was learned). Each row represents a dynamically learned MAC-to-port mapping. A healthy network shows expected MACs on correct ports.
Unexpected MACs may indicate loops, misconfigurations, or rogue devices. Missing expected MACs could point to connectivity issues or VLAN mismatches. The total count helps verify the number of learned hosts.
Configuration Scenarios
Verify Dynamic MAC Address Learning on Access Port
A new PC is connected to switch port GigabitEthernet0/1 in VLAN 10. The network administrator wants to confirm that the switch has learned the PC's MAC address and that the port is correctly assigned to VLAN 10.
Topology
PC1---(Gi0/1)SW1Steps
- 1.Step 1: Connect the PC to port Gi0/1 and ensure the PC is powered on and sending traffic (e.g., ping the default gateway).
- 2.Step 2: Enter privileged EXEC mode on SW1: SW1> enable
- 3.Step 3: Display the MAC address table for VLAN 10: SW1# show mac address-table dynamic vlan 10
- 4.Step 4: Verify that the PC's MAC address appears with interface Gi0/1 and type DYNAMIC.
! No configuration needed for dynamic learning; ensure VLAN 10 exists SW1(config)# vlan 10 SW1(config-vlan)# exit SW1(config)# interface GigabitEthernet0/1 SW1(config-if)# switchport mode access SW1(config-if)# switchport access vlan 10
Verify: SW1# show mac address-table dynamic vlan 10 Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 10 0050.7966.6800 DYNAMIC Gi0/1 Total Mac Addresses for this criterion: 1
Watch out: If the PC is not sending any frames (e.g., no network activity), the MAC address will not appear. Generate traffic by pinging the gateway or using 'ping' from the PC.
Identify MAC Address Flapping Between Two Ports
A switch log shows MAC address flapping errors for MAC address 0050.7966.6800 between ports Gi0/1 and Gi0/2. The administrator needs to confirm the flapping and identify the correct port.
Topology
PC1---(Gi0/1)SW1(Gi0/2)---Unauthorized HubSteps
- 1.Step 1: Enter privileged EXEC mode: SW1> enable
- 2.Step 2: Display the MAC address table for the specific MAC: SW1# show mac address-table dynamic | include 0050.7966.6800
- 3.Step 3: Observe if the MAC appears on multiple ports or alternates between them.
- 4.Step 4: Check the MAC address table multiple times to see if the port changes: SW1# show mac address-table dynamic address 0050.7966.6800
- 5.Step 5: If flapping is confirmed, investigate the physical topology (e.g., look for loops or unauthorized devices).
! No configuration needed; flapping is a symptom of a loop or misconfiguration ! To mitigate, enable port security or storm control SW1(config)# interface GigabitEthernet0/2 SW1(config-if)# switchport port-security SW1(config-if)# switchport port-security maximum 1 SW1(config-if)# switchport port-security violation shutdown
Verify: SW1# show mac address-table dynamic address 0050.7966.6800 Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 10 0050.7966.6800 DYNAMIC Gi0/1 (If flapping, the port may change on subsequent queries.)
Watch out: MAC address flapping can also occur due to a bridging loop. Check spanning-tree status with 'show spanning-tree' to see if any ports are in blocking or listening state.
Troubleshooting with This Command
When troubleshooting Layer 2 connectivity issues, the 'show mac address-table dynamic' command is often the first step in verifying that the switch is learning MAC addresses correctly. Healthy output shows each MAC address appearing on exactly one port per VLAN, with the type 'DYNAMIC'. Problem indicators include: missing MAC addresses (device not sending traffic, wrong VLAN, or port issues), MAC addresses appearing on unexpected ports (possible loop or unauthorized device), or the same MAC address appearing on multiple ports (flapping).
Key fields to focus on are the VLAN, MAC address, and Port columns. Common symptoms this command helps diagnose include: a device cannot ping its default gateway (check if the switch has learned the device's MAC on the correct port and VLAN), intermittent connectivity (check for flapping), or high CPU utilization due to flooding (check if many unknown unicast frames are being flooded because MAC addresses are not learned). A step-by-step diagnostic flow: 1) Verify the device is connected and powered on. 2) Generate traffic from the device (e.g., ping). 3) On the switch, run 'show mac address-table dynamic' to see if the MAC appears. 4) If not, check the port status with 'show interfaces status' and 'show interfaces [interface] switchport' to ensure the port is up and in the correct VLAN. 5) If the MAC appears on the wrong port, check for loops or misconfigurations. 6) If flapping is observed, use 'show logging' to see flapping messages and 'show spanning-tree' to check for topology changes.
Correlate with 'show interfaces [interface]' for input/output errors, and 'debug mac address-table' for real-time learning events (use with caution in production). The command can also be used to verify that static MAC addresses are not interfering with dynamic learning. In summary, this command is a powerful tool for isolating Layer 2 issues and should be used in conjunction with other show commands for a complete picture.
CCNA Exam Tips
CCNA exam tip: Remember that 'show mac address-table dynamic' only shows entries learned via incoming frames, not static or secure MACs.
CCNA exam tip: Know that dynamic MAC entries age out by default after 300 seconds (configurable with 'mac address-table aging-time').
CCNA exam tip: Be able to identify which port a given MAC is on; exam may ask you to trace a frame's path based on MAC table.
CCNA exam tip: Understand that the MAC address table is used for Layer 2 forwarding decisions; a missing entry can cause flooding.
Common Mistakes
Mistake 1: Confusing dynamic entries with static or secure entries; use 'show mac address-table' to see all types.
Mistake 2: Forgetting that the MAC table is per-VLAN; a MAC learned in one VLAN won't appear in another.
Mistake 3: Assuming the output shows all MACs; it only shows dynamic entries unless you specify otherwise.
show mac address-table dynamic vs show mac address-table
Both commands display the MAC address table on a Cisco switch, but they differ in filtering. 'show mac address-table dynamic' shows only entries learned dynamically via SMAC learning, while 'show mac address-table' includes all types (static, dynamic, secure, and default). They are commonly confused because the base command can produce many entries, making the dynamic filter useful for troubleshooting.
| Aspect | show mac address-table dynamic | show mac address-table |
|---|---|---|
| Scope | Only dynamically learned entries | All MAC address entries (static, dynamic, secure, default) |
| Output verbosity | Concise, focused on dynamic entries | Potentially verbose with many types |
| Troubleshooting focus | Verify devices learned via SMAC learning on ports/VLANs | General inspection of entire CAM table |
| Filtering capability | Built-in filter for dynamic only | No filter; shows all types |
| Common use case | Check if MACs are being dynamically learned as expected | Validate static entries or detect unauthorized static MACs |
Use show mac address-table dynamic when you need to confirm that devices are being learned via dynamic MAC learning and to identify which ports and VLANs are active with recently learned hosts.
Use show mac address-table when you need a complete view of the CAM table, including static, secure, and default entries, to verify all Layer 2 forwarding paths or detect misconfigurations.
Platform Notes
In IOS-XE (e.g., Catalyst 3650/3850/9300), the command syntax and output are identical to classic IOS. However, on newer platforms, the MAC address table may be referred to as the 'Layer 2 forwarding table' and the command 'show mac address-table' works the same. In NX-OS (e.g., Nexus 9000), the equivalent command is 'show mac address-table dynamic' but the output format differs slightly (e.g., columns: VLAN, MAC, Type, Ports).
NX-OS also supports 'show mac address-table' with similar parameters. For ASA firewalls, the command does not exist; instead, use 'show mac-address-table' (note hyphen) to display the MAC address table for bridge groups. In IOS-XR (e.g., ASR 9000), the command is 'show mac-address-table' (with hyphen) and the output is similar to IOS but may include additional fields like 'BD' (bridge domain).
Between IOS versions (12.x, 15.x, 16.x), the command behavior is consistent, but the output may include additional columns like 'Age' in newer versions. Always check the specific platform documentation for exact syntax. For CCNA/CCNP exams, the classic IOS syntax is tested, but awareness of NX-OS differences is beneficial.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions