Courseiva
SecurityPrivileged EXEC

show port-security address

Displays the secure MAC addresses configured on all switch ports or a specific interface, used to verify port security address learning and aging.

Definition: show port-security address is a Cisco IOS privileged exec command. Displays the secure MAC addresses configured on all switch ports or a specific interface, used to verify port security address learning and aging.

Overview

The `show port-security address` command is a vital diagnostic tool in Cisco IOS for verifying the operation of port security on switch interfaces. Port security is a Layer 2 security feature that restricts input to a switch port by limiting the MAC addresses allowed to send traffic through that port. This command displays the secure MAC addresses that have been learned or statically configured on all switch ports or a specific interface, along with their aging status and type (dynamic, static, or sticky).

Understanding this command is essential for CCNA and CCNP candidates because port security is a common exam topic and a real-world security control used to prevent unauthorized devices from connecting to the network. The command is typically used after configuring port security to confirm that MAC addresses are being learned correctly, to verify that sticky MAC addresses have been saved, or to troubleshoot issues where a port is err-disabled due to a security violation. Unlike `show port-security interface`, which shows the security settings and violation counts per interface, `show port-security address` focuses on the actual MAC addresses learned, making it the go-to command for auditing which devices are currently allowed on a port.

In the broader workflow, this command is often used in conjunction with `show mac address-table` to compare the MAC addresses learned by the switch with those secured by port security. The command runs in privileged EXEC mode (enable) and does not require any special privilege level beyond 15. Its output is buffered, meaning it may not reflect real-time changes if the switch is under heavy load; in such cases, using the `clear port-security` command or waiting for the next polling cycle may be necessary.

The command does not affect the running configuration; it is purely a show command. However, the information displayed can be used to verify that sticky MAC addresses have been added to the running config, which is important for ensuring persistence after a reload. The command supports filtering by interface, which is useful for isolating issues on a specific port.

Overall, mastering this command helps network engineers quickly validate port security configurations and troubleshoot connectivity issues caused by MAC address restrictions.

Syntax·Privileged EXEC
show port-security address

When to Use This Command

  • Verify which MAC addresses have been learned on a port with port security enabled after connecting a new device.
  • Troubleshoot a port security violation by checking if the MAC address of an authorized device is present in the table.
  • Monitor the number of secure MAC addresses currently learned on an interface to ensure it does not exceed the maximum limit.
  • Confirm that sticky MAC addresses have been correctly saved to the running configuration.

Parameters

ParameterSyntaxDescription
interface-ide.g., GigabitEthernet0/1, FastEthernet0/1Specifies a particular interface to display secure MAC addresses for. If omitted, the command shows addresses for all interfaces. Common mistakes include using an incorrect interface name or number, or forgetting that the interface must have port security enabled to show any addresses.

Command Examples

Display all secure MAC addresses on the switch

show port-security address
               Secure Mac Address Table
-----------------------------------------------------------------------------
Vlan    Mac Address       Type                          Ports   Remaining Age
                                                                   (mins)
----    -----------       ----                          -----   -------------
   1    0050.7966.6800    SecureDynamic                 Gi0/1        -
   1    0050.7966.6801    SecureSticky                  Gi0/2        -
  10    0050.7966.6802    SecureConfigured              Gi0/3        -
  10    0050.7966.6803    SecureDynamic                 Gi0/4       15
-----------------------------------------------------------------------------
Total Addresses in System (excluding one mac per port)     : 4
Max Addresses limit in System (excluding one mac per port) : 1024

Vlan: VLAN ID of the secure address. Mac Address: The learned or configured MAC address. Type: How the address was learned (SecureDynamic = dynamically learned, SecureSticky = sticky learning, SecureConfigured = manually configured). Ports: Interface where the address is secured. Remaining Age (mins): Time left before the address ages out (dash means no aging). Total/Max: System-wide counts.

Display secure MAC addresses for a specific interface

show port-security address interface gigabitEthernet 0/1
               Secure Mac Address Table
-----------------------------------------------------------------------------
Vlan    Mac Address       Type                          Ports   Remaining Age
                                                                   (mins)
----    -----------       ----                          -----   -------------
   1    0050.7966.6800    SecureDynamic                 Gi0/1        -
-----------------------------------------------------------------------------
Total Addresses in System (excluding one mac per port)     : 1
Max Addresses limit in System (excluding one mac per port) : 1024

Filters output to show only addresses on Gi0/1. Useful for isolating a specific port's security status.

Understanding the Output

The output displays a table of secure MAC addresses learned on switch ports. The 'Vlan' column indicates the VLAN of the address. 'Mac Address' shows the 48-bit MAC in dotted-hex format.

'Type' reveals how the address was learned: SecureDynamic (dynamically learned and will age out), SecureSticky (dynamically learned but saved to config), or SecureConfigured (manually configured via switchport port-security mac-address). 'Ports' lists the interface. 'Remaining Age' shows minutes until the address ages out; a dash means aging is disabled (e.g., for sticky or configured addresses).

The bottom lines show total system addresses and the maximum allowed. In a real network, you would check that expected MACs are present, that the count is below the maximum, and that no unauthorized MACs appear. A missing expected MAC could indicate a violation or misconfiguration.

Configuration Scenarios

Verify Port Security with Sticky MAC Addresses on an Access Port

A network administrator has configured port security with sticky MAC learning on a switch port connecting to a single workstation. They need to verify that the workstation's MAC address has been learned and saved as a sticky address.

Topology

SW1(Gi0/1)---PC1 (MAC: 0050.7966.6800)

Steps

  1. 1.Step 1: Enter privileged EXEC mode: SW1> enable
  2. 2.Step 2: Display secure MAC addresses for interface Gi0/1: SW1# show port-security address interface gigabitEthernet 0/1
  3. 3.Step 3: Observe the output to confirm the MAC address 0050.7966.6800 is listed with type 'Sticky' and age '-' (since sticky addresses do not age out).
Configuration
! Configuration on SW1
interface GigabitEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
 switchport port-security violation restrict
!

Verify: Command: show port-security address interface gigabitEthernet 0/1 Expected output: Secure Mac Address Table ----------------------------------------------------------------------------- Vlan Mac Address Type Ports Remaining Age (mins) ---- ----------- ---- ----- -------------------- 1 0050.7966.6800 Sticky Gi0/1 - ----------------------------------------------------------------------------- Total Addresses in System: 1 Max Addresses limit in System: 1024

Watch out: If the sticky MAC address does not appear, ensure that the workstation has sent traffic through the port. Sticky addresses are only learned when the switch sees a frame from that MAC. Also, verify that port security is enabled and the maximum number of addresses is not already reached.

Troubleshoot a Port in Err-Disabled State Due to Port Security Violation

A switch port has gone into err-disabled state because a security violation occurred (e.g., a different MAC address attempted to use the port). The administrator needs to identify which MAC addresses were learned before the violation and which caused the violation.

Topology

SW1(Gi0/2)---Unauthorized device (MAC: 0a1b.2c3d.4e5f) and Authorized PC (MAC: 0050.7966.6801)

Steps

  1. 1.Step 1: Check the port status: SW1# show interfaces gigabitEthernet 0/2 status
  2. 2.Step 2: If the port is err-disabled, examine the secure MAC addresses: SW1# show port-security address interface gigabitEthernet 0/2
  3. 3.Step 3: Note the MAC addresses listed. If the unauthorized MAC is not in the list, it means it was not learned before the violation. Check the violation count: SW1# show port-security interface gigabitEthernet 0/2
  4. 4.Step 4: Recover the port by issuing: SW1(config-if)# shutdown and then no shutdown, or use the errdisable recovery cause psecure-violation command.
Configuration
! Configuration on SW1
interface GigabitEthernet0/2
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation shutdown
!

Verify: Command: show port-security address interface gigabitEthernet 0/2 Expected output (before violation): Secure Mac Address Table ----------------------------------------------------------------------------- Vlan Mac Address Type Ports Remaining Age (mins) ---- ----------- ---- ----- -------------------- 1 0050.7966.6801 Sticky Gi0/2 - ----------------------------------------------------------------------------- Total Addresses in System: 1 Max Addresses limit in System: 1024 After violation, the port is err-disabled and the command may show no addresses if the sticky address was removed, or the same address if the violation was due to exceeding the maximum.

Watch out: When a port goes err-disabled due to a security violation, the secure MAC addresses may be cleared depending on the violation mode. With 'shutdown' mode, the port is disabled and all learned MAC addresses are removed. To preserve the sticky addresses, use 'restrict' or 'protect' mode. Always check the violation mode before troubleshooting.

Troubleshooting with This Command

When troubleshooting port security issues, the `show port-security address` command is essential for verifying which MAC addresses are currently secured on a port. Healthy output shows a list of MAC addresses with their VLAN, type (Dynamic, Static, or Sticky), port, and remaining age (in minutes). For sticky addresses, the age is shown as '-' because they do not age out.

For dynamic addresses, the age counts down from the configured aging time (default is 0, meaning no aging). Problem indicators include: no addresses listed when there should be (e.g., after a violation or if the port is err-disabled), addresses of type 'Dynamic' when sticky was expected, or addresses with a very low remaining age (indicating they are about to be aged out). Key fields to focus on are the 'Type' and 'Remaining Age' columns.

If the type is 'Dynamic' but you configured sticky, it means the sticky keyword was not applied or the MAC was learned before sticky was enabled. If the remaining age is low, check the aging time configuration with `show port-security interface`. Common symptoms this command helps diagnose include: a port that intermittently drops traffic (due to MAC address aging), a port that goes err-disabled (check if the violating MAC appears in the table), or a port that does not learn any MAC addresses (port security may be disabled or the maximum limit is set to 0).

A step-by-step diagnostic flow: 1) Check the port status with `show interfaces status` or `show interfaces <interface>`. If err-disabled, note the reason. 2) Use `show port-security interface <interface>` to see the violation count and security settings. 3) Use `show port-security address interface <interface>` to see learned MACs. If no MACs are shown but the port is up, ensure that devices are sending traffic. 4) Compare the output with `show mac address-table interface <interface>` to see all MACs learned by the switch (including those not secured).

If a MAC appears in the MAC table but not in port-security address, it may be because port security is not enabled or the MAC was learned before port security was turned on. 5) If sticky addresses are missing after a reload, verify that the sticky addresses were saved to the running config (they are not saved automatically unless you write memory). Correlate with `show running-config interface <interface>` to see if the sticky MAC addresses appear as `switchport port-security mac-address sticky <mac>`. If not, they were lost.

Also, use `debug port-security` to see real-time learning events, but be cautious as it can be CPU-intensive. In summary, `show port-security address` is the primary command for auditing which devices are allowed on a port and for diagnosing learning or aging issues.

CCNA Exam Tips

1.

CCNA exam may ask you to identify the type of secure MAC address based on output (Dynamic vs Sticky vs Configured).

2.

Remember that SecureSticky addresses appear in the running-config, while SecureDynamic do not.

3.

The 'Remaining Age' column is only populated for dynamically learned addresses; sticky and configured show a dash.

4.

Know that the maximum number of secure MAC addresses per port is configured with 'switchport port-security maximum'.

Common Mistakes

Confusing SecureSticky with SecureConfigured: Sticky addresses are learned dynamically and then saved, while Configured are manually entered.

Assuming all secure MAC addresses are saved to running-config: Only sticky and configured addresses are saved; dynamic ones are lost on reload.

Forgetting that the 'Remaining Age' field shows minutes, not seconds, and that a dash means no aging is configured.

show port-security address vs show port-security

Both 'show port-security address' and 'show port-security' are used to verify port security on Cisco switches, but they serve distinct purposes. They are commonly confused because the former is a subset of the information displayed by the latter, yet each command provides unique details critical for troubleshooting.

Aspectshow port-security addressshow port-security
Output FocusSecure MAC addresses per interfacePort security configuration and status per interface
MAC Address DetailLists learned and configured MACs with type and aging infoOnly counts of secure MACs, not individual addresses
Violation InformationDoes not show violation counts or actionsDisplays violation count, action, and last violation source
Interface ScopeShows address table for all or specified interfaceShows configuration summary for all or specified interface
Aging DetailsDisplays remaining time, type (absolute/inactivity)Only shows aging time and type configuration, not per-address remaining

Use 'show port-security address' when you need to see the specific MAC addresses learned or configured on each port, along with their aging status.

Use 'show port-security' when you need an overview of port security configuration, violation status, and counts of secure MACs per interface.

Platform Notes

In IOS-XE (e.g., Catalyst 3650/3850/9300), the `show port-security address` command syntax and output are identical to classic IOS. However, on some IOS-XE platforms, the output may include additional fields such as 'Secure Port' or 'Remaining Age' in a slightly different format. For example, on IOS-XE 16.x, the 'Remaining Age (mins)' column may be labeled 'Age (min)'.

The command is fully supported. In NX-OS (e.g., Nexus 9000), the equivalent command is `show port-security address` as well, but the output format differs: it shows a table with columns for 'Interface', 'Vlan', 'Mac Address', 'Type', and 'Age'. Additionally, NX-OS uses the term 'port-security' but the configuration is done under interface with `switchport port-security`.

On NX-OS, the command also supports the `interface` keyword. For ASA firewalls, port security is not a feature; instead, MAC address filtering is done via access-lists or MAC authentication bypass. Therefore, there is no direct equivalent.

In IOS-XR (e.g., ASR 9000), port security is not supported in the same way; the platform uses MACsec or other security mechanisms. The command does not exist in IOS-XR. Between IOS versions, the command has remained largely consistent from 12.x to 15.x to 16.x.

One minor difference: in older IOS 12.x, the output might not show the 'Remaining Age' column if aging is disabled. In 15.x and later, the column always appears. Also, the maximum number of secure MAC addresses per system (shown in the output footer) may vary by platform and IOS version, typically 1024 or 4096.

Always check the specific platform documentation for exact limits.

Related Commands

show port-security

Displays the port security configuration and status on switch interfaces, used to verify and troubleshoot port security settings.

show port-security interface [intf]

Displays port security configuration and status for a specific interface, including secure MAC addresses, violation counts, and action taken.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions