I have a port on a switch configured with port-security and sticky option.

interface FastEthernet0/18
 switchport port-security maximum 2
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security mac-address sticky 78e7.d1b4.8e14
 switchport port-security mac-address sticky 0060.b955.c003 vlan voice

The IP phone is no longer connected to this port. If I show the MAC addresses on the port, both addresses are shown.

#show mac address-table int fa0/18
 Mac Address Table
Vlan Mac Address Type Ports
---- ----------- -------- -----
 491 0060.b955.c003 STATIC Fa0/18
 413 78e7.d1b4.8e14 STATIC Fa0/18
Total Mac Addresses for this criterion: 2

How can I view only the active MAC address, not including sticky addresses no longer there? show mac address-table dynamic does not show the one still there because it is now static due to being recorded by the sticky statement.

By active, I mean that the device is still connected and sending packets on that port - as opposed to just still be recorded as a sticky mac address.

Netdisco, for example, is somehow able to tell the difference when it performs its macsuck operation:

select mac, port, active from node where port = 'FastEthernet0/18';

mac                 port                active
78:e7:d1:b4:8e:14   FastEthernet0/18    true
00:60:b9:55:c0:03   FastEthernet0/18    false
  • 1
    How are you defining "active?"
    – Ron Trunk
    Feb 17, 2016 at 0:50
  • @RonTrunk - see edit at the end of the post.
    – ETL
    Feb 17, 2016 at 0:53
  • 1
    Apparently, Netdisco is using SNMP to discover this sort of thing, and it seem to have problems with various Cisco switches and/or IOS versions. Regardless, you will never know immediately if a MAC address is inactive since the switch will need to time out the activity from somewhere since it has no way to know what MAC address is on a port unless it is specifically configured, or from traffic on the port.
    – Ron Maupin
    Feb 17, 2016 at 1:35

3 Answers 3


As long as the MAC is statically assigned to the port, it will always appear in the tables. As far as the switch is concerned, it's always "active".

The only way to know it's there is to ping it, check the dhcp snooping tables, etc. MAC port learning will not work.

  • Somehow however, netdisco is able to make a difference as it shows me only "active" MAC address on that example port.
    – ETL
    Feb 17, 2016 at 1:05
  • netdisco uses SNMP, which often will provide stuff the CLI doesn't.
    – Ricky
    Feb 17, 2016 at 2:22
  • well that's a bummer that it's not possible through CLI
    – ETL
    Feb 17, 2016 at 2:32

A switch learns that a particular MAC address is on a port due to traffic on that port. It will retain this in the MAC address table until it times out the entry (which is reset when there is more traffic from that MAC address on that port). You can specifically tell the port that the MAC address entry should never expire, as you do.

Cisco switches allow you to adjust the timeout period for the MAC address table with the mac address-table aging-time command. (Some IOS versions have the dashes differently.)


When you configure sticky option in a port-secure, the mac address is added to the Mac Address Table as Static. In order to remove this address from the Mac Address you can use the global config command

(config)#no mac address-table static xxxx.xxxx.xxxx vlan yy

This mac address remains in the Secure Mac Address Table even though it is not in the Mac Address Table. You can check this with:

#show port-security address

To remove the mac address from the Secure Mac Address table, go to interface configuration and:

(config-if)#no switchport port-security
(config-if)#switchport port-security

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.